last executing test programs: 3.21924827s ago: executing program 1 (id=16342): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000140)={'wpan0\x00'}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000980)={&(0x7f0000000900)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x9, [@ptr={0xd, 0x0, 0x0, 0x2, 0x4}]}, {0x0, [0x30, 0x0, 0x5f, 0x5f, 0x30, 0x30, 0x5f]}}, &(0x7f0000000940)=""/8, 0x2d, 0x8, 0x1, 0x2}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=@base={0x2, 0x3ff, 0x3, 0x4, 0x10201, 0xffffffffffffffff, 0xfffffffe, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x7, 0x5}, 0x50) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x300440c4) write$bt_hci(0xffffffffffffffff, &(0x7f0000000500)={0x1, @write_ssp_mode={{0xc56, 0x1}, {0x54}}}, 0x5) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e0138", 0x33}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504", 0x6e}, {0x0}, {&(0x7f0000000800)}], 0x4}}, {{0x0, 0x0, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)}, {&(0x7f0000000580)}], 0x3}}], 0x2, 0x20000044) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f00000000c0)=[{&(0x7f0000000180)}], 0x1, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r6, 0x0, 0x25a5, 0x0) recvmmsg(r5, &(0x7f000000c0c0)=[{{0x0, 0x0, &(0x7f0000004380)=[{&(0x7f00000032c0)=""/4096, 0x1000}], 0x1}, 0x9}, {{0x0, 0x0, 0x0}, 0x81}], 0x2, 0x100, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r2, 0x4048587b, &(0x7f00000007c0)={{r1, &(0x7f0000000280)='N\x00', 0x400000, &(0x7f0000000300)={@align=0xffff, {0x6, 0xf5, 0x81, 0x53fec7d6}}, 0x80, &(0x7f0000000540)={@_ha_fsid}, &(0x7f0000000640)=0x1}, 0x1, &(0x7f0000000780)=[{0x1, 0xfff, &(0x7f0000000680)='wpan0\x00', &(0x7f00000006c0)="bd4cafc148146d9e4191da22dae2ec33fcb570e36b5252f3f39cede5edfd8ff9a85fa1bf18c2004575f772d2e4f118dcfa8f4724277eefc8e281801ccbfb6a51aabc421a67c99cf7206ebc6c722e2f9143bed438f922771a964b9fb48de18281640b6972217b92dd017a60cadc61302673aff7b236eac8b7cb8e05f4f07e8cab75aecee0b00f1db803b250839bb4c479cf54d6b63ec753395b", 0x99, 0x8}]}) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x1, &(0x7f0000000840)=@gcm_256={{0x304}, "360e250beb233aaf", "dcf3b1c015a4e7ccdf526aab8dc596d55ae06bbb08c848e98f9579167031bec7", "65ddb877", "217eadc67e583e3a"}, 0x38) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r8 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r9, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r10, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 2.284671405s ago: executing program 3 (id=16358): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) sendmmsg$inet6(r0, 0x0, 0x0, 0x931766f6319eed44) bind$alg(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r2, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r4 = accept(r2, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYRES64, @ANYRES64, @ANYRES8=r1], 0xfffffdef}, 0x1, 0x0, 0x0, 0x44000}, 0x0) recvfrom(r3, 0x0, 0x0, 0x10040, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c0000001800dd8d000000000000000002"], 0x3c}, 0x1, 0x0, 0x0, 0x20000010}, 0x200000a0) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) socket$qrtr(0x2a, 0x2, 0x0) 2.246254419s ago: executing program 1 (id=16359): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000640)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf20000000000000070000000f0000002d030100000000007300ffb1000000006926000000000000bf67000000000000150002000fff52004507000010000000d60600000ee60000bf0500000000000073700000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f900bd430100000000009500000000000000050000000000000095000000000000001c15a3ce747c693a74b62fd0758b15f09429c09074bc4b2bd2dc480dd7a064b8473e2060d60bb39d0af449deaa27ea949e8f9000d885dfea2783835e29eb532ba8546fc020c196738b5f32b095f5d5b196b9e8d897e461c01c697671d1000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r0, &(0x7f00000000c0), &(0x7f0000000000)=""/10, 0x2}, 0x20) (async) bpf$MAP_GET_NEXT_KEY(0x3, &(0x7f00000001c0)={r0, &(0x7f0000000240), 0x0}, 0x20) (async) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000280)={0xffffffff}, 0x10) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000080)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) (async) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x12, 0xa01, 0x0, 0x0, {0xa}}, 0x26}}, 0x0) r3 = accept4(r1, 0x0, 0x0, 0x80800) read$alg(r3, &(0x7f0000000000)=""/46, 0x2e) sendmmsg$alg(r3, &(0x7f00000035c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x810}], 0x1, 0x84) (async) recvmsg$can_raw(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000440)=""/127, 0x7f}], 0x1}, 0x40) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x2, 0x0) bind$unix(r5, &(0x7f0000000000)=@file={0x1, './cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) (async) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x54, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x24, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MLD_VERSION={0x5, 0x2c, 0x1}, @IFLA_BR_MCAST_QUERY_USE_IFADDR={0x5}, @IFLA_BR_MCAST_QUERIER={0x5}, @IFLA_BR_MCAST_SNOOPING={0x5, 0x17, 0x1}]}}}]}, 0x54}}, 0x0) 2.064503764s ago: executing program 1 (id=16363): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_MATCH_INFO={0x14, 0x3, "f4f03b0200000000000000116b61979e"}, @NFTA_MATCH_NAME={0x9, 0x1, 'l2tp\x00'}, @NFTA_MATCH_REV={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x94}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r6, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) r8 = socket(0x200000000000011, 0x2, 0xd) bind$packet(r8, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x8000}, 0x4) syz_emit_ethernet(0x32, &(0x7f00000007c0)={@random="e90c610faca2", @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0x3, 0x11, 0x0, @empty, @empty}, {0x0, 0xfffe, 0x27, 0x0, @gue={{0x2, 0x0, 0x2, 0x1}}}}}}}, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000bc0)={@link_local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x8}}}}}, 0x0) sendmsg$NL80211_CMD_TDLS_OPER(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x44, r4, 0x800, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_TDLS_OPERATION={0x5, 0x8a, 0x1}, @NL80211_ATTR_TDLS_OPERATION={0x5, 0x8a, 0x1}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0xcfb4854c0caad94c) socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet6(0xa, 0x2, 0x0) socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00'}) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0xffff}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_XFRM_IF_ID={0x8, 0x2, 0xea}]}}}]}, 0x3c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r11, @ANYBLOB="0000000003120100500012800b000100627269646765000040000280080005000100000006002700000f"], 0x70}, 0x1, 0x0, 0x0, 0x2800}, 0x40) 1.895969217s ago: executing program 2 (id=16364): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0xffe0}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x81}, 0x20000010) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x200, 0x70bd25, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4000) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x2, &(0x7f0000000040)=0x3, 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000001e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_HASH_SREG={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HASH_DREG={0x8, 0x2, 0x1, 0x0, 0xa}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) r6 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=ANY=[@ANYBLOB="14000000040000000800000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000200)={r6, &(0x7f0000000140), 0x0}, 0x20) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r1, @ANYBLOB="00001700000000001c0037800b0001006970768a616e08000c000200cb"], 0x44}, 0x1, 0x0, 0x0, 0x200480d8}, 0x8080) 1.89556451s ago: executing program 0 (id=16366): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_FLUSH(r0, 0x0, 0xd4, &(0x7f00000000c0)=0x8, 0x4) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8b06, &(0x7f0000000080)={'bond_slave_1\x00', @local}) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x3, 0x20010, r1, 0x117fe000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x9c, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x9c}, 0x1, 0x0, 0x0, 0x4041}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0xa0, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_TUPLE_ORIG={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x4}]}, 0xa0}}, 0x0) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000040)=0xffe, 0x4) socket$igmp(0x2, 0x3, 0x2) (async) setsockopt$MRT_FLUSH(r0, 0x0, 0xd4, &(0x7f00000000c0)=0x8, 0x4) (async) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) ioctl$SIOCSIFHWADDR(r1, 0x8b06, &(0x7f0000000080)={'bond_slave_1\x00', @local}) (async) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x3, 0x20010, r1, 0x117fe000) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x9c, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x9c}, 0x1, 0x0, 0x0, 0x4041}, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$IPCTNL_MSG_CT_GET(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0xa0, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_TUPLE_ORIG={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x4}]}, 0xa0}}, 0x0) (async) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000040)=0xffe, 0x4) (async) 1.716269805s ago: executing program 4 (id=16367): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="80000000", @ANYRES16=r1, @ANYBLOB="050000000000000000000200000008000300", @ANYRES32=r2, @ANYBLOB="2d000e0080000000ffffffffffff08021100000008021100000000000000000100000000640000002503000000000000080026006c09"], 0x80}}, 0x0) 1.6233561s ago: executing program 1 (id=16368): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r1) sendmsg$IEEE802154_ADD_IFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000002100000009001f00706879f529000000050020"], 0x28}}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') socket(0x21, 0x4, 0x2) r3 = accept4(r0, &(0x7f00000000c0)=@ethernet={0x0, @broadcast}, &(0x7f00000001c0)=0x80, 0x80800) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r5) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x30, r6, 0x1, 0x0, 0x0, {0x3, 0x74, 0x600}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'ip6gre0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x7}]}, 0x30}, 0x1, 0xffffffff00000003}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r1, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, r6, 0x100, 0x70bd29, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_to_batadv\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x40800}, 0x8045) setsockopt$WPAN_WANTLQI(r3, 0x0, 0x3, &(0x7f0000000200)=0x1, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x500}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) 1.551953585s ago: executing program 2 (id=16369): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000140)={'wpan0\x00'}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000980)={&(0x7f0000000900)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x9, [@ptr={0xd, 0x0, 0x0, 0x2, 0x4}]}, {0x0, [0x30, 0x0, 0x5f, 0x5f, 0x30, 0x30, 0x5f]}}, &(0x7f0000000940)=""/8, 0x2d, 0x8, 0x1, 0x2}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=@base={0x2, 0x3ff, 0x3, 0x4, 0x10201, 0xffffffffffffffff, 0xfffffffe, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x7, 0x5}, 0x50) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x300440c4) write$bt_hci(0xffffffffffffffff, &(0x7f0000000500)={0x1, @write_ssp_mode={{0xc56, 0x1}, {0x54}}}, 0x5) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e0138", 0x33}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504", 0x6e}, {0x0}, {&(0x7f0000000800)}], 0x4}}, {{0x0, 0x0, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)}, {&(0x7f0000000580)}], 0x3}}], 0x2, 0x20000044) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f00000000c0)=[{&(0x7f0000000180)}], 0x1, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r6, 0x0, 0x25a5, 0x0) recvmmsg(r5, &(0x7f000000c0c0)=[{{0x0, 0x0, &(0x7f0000004380)=[{&(0x7f00000032c0)=""/4096, 0x1000}], 0x1}, 0x9}, {{0x0, 0x0, 0x0}, 0x81}], 0x2, 0x100, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r2, 0x4048587b, &(0x7f00000007c0)={{r1, &(0x7f0000000280)='N\x00', 0x400000, &(0x7f0000000300)={@align=0xffff, {0x6, 0xf5, 0x81, 0x53fec7d6}}, 0x80, &(0x7f0000000540)={@_ha_fsid}, &(0x7f0000000640)=0x1}, 0x1, &(0x7f0000000780)=[{0x1, 0xfff, &(0x7f0000000680)='wpan0\x00', &(0x7f00000006c0)="bd4cafc148146d9e4191da22dae2ec33fcb570e36b5252f3f39cede5edfd8ff9a85fa1bf18c2004575f772d2e4f118dcfa8f4724277eefc8e281801ccbfb6a51aabc421a67c99cf7206ebc6c722e2f9143bed438f922771a964b9fb48de18281640b6972217b92dd017a60cadc61302673aff7b236eac8b7cb8e05f4f07e8cab75aecee0b00f1db803b250839bb4c479cf54d6b63ec753395b", 0x99, 0x8}]}) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x1, &(0x7f0000000840)=@gcm_256={{0x304}, "360e250beb233aaf", "dcf3b1c015a4e7ccdf526aab8dc596d55ae06bbb08c848e98f9579167031bec7", "65ddb877", "217eadc67e583e3a"}, 0x38) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r8 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r9, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r10, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 1.548849863s ago: executing program 0 (id=16370): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2c00000014002101000000000000000023000000", @ANYRES32=0x0, @ANYBLOB="040002"], 0x2c}, 0x1, 0xfdffffff}, 0x0) 1.51798507s ago: executing program 4 (id=16371): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001900)=ANY=[@ANYBLOB="61103400000000006113380000000000bfa00000000000000700000008ffffffd50301001874004095000600000000006916000000000000bf67000000000000360607000fff07201706000020190000160300000ee60060bf050000000000007b650000000000006507f9ff01000000070700004ddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d2aca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c437dc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc28206c812439ab129ae818837ee15620789c524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418df19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c747664e9f7478f8200"/1582], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_INFO={0x18, 0x3, "c6a41d10ff0000f500e906000000000000070000"}, @NFTA_MATCH_NAME={0xa, 0x1, 'owner\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}}, 0x4048010) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000000)={0x0, 0x0}, 0x8) r3 = socket$qrtr(0x2a, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000ac0)=[{{0x0, 0x48, 0x0}}], 0x1, 0x0, 0x0) connect$qrtr(r3, &(0x7f0000000040)={0x2a, 0x1}, 0xc) writev(r3, &(0x7f0000000340)=[{&(0x7f0000000080)='~', 0x1}], 0x1000000000000173) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x0, 0xf, &(0x7f00000002c0)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r2, r0}, 0x90) 1.411412675s ago: executing program 0 (id=16372): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newqdisc={0x54, 0x10, 0x1, 0x70bd25, 0x25dfdbfc, {0x6, 0x0, 0x8100, 0x0, {0x1, 0x10}, {0xfff1}, {0xe, 0x10}}, [@TCA_RATE={0x6, 0x5, {0xfc}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x8, 0x11}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x400c800}, 0x0) 1.350231317s ago: executing program 3 (id=16373): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket(0x1e, 0x1, 0x0) connect$tipc(r1, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x2, 0xb, 0xe, 0x9, 0x6, 0x0, 0x70bd25, 0x25dfdbfe, [@sadb_lifetime={0x4, 0x3, 0x4, 0x5, 0xf, 0x10000000000001}]}, 0x30}}, 0x4000) (async) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x38, 0x2, 0x6, 0x5, 0x0, 0x0, {0x6}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0xeaa7}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) (async) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000340)=0x152, 0x4) setsockopt$inet6_int(r2, 0x29, 0x31, &(0x7f0000000080)=0xb2, 0x4) (async, rerun: 32) sendmmsg$inet6(r2, &(0x7f00000002c0)=[{{&(0x7f0000000b00)={0xa, 0x4e23, 0x7, @mcast2}, 0x1c, 0x0}}], 0x1, 0x24040000) (rerun: 32) recvmmsg(r2, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}, 0xdb31}], 0x1, 0x40002102, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r5 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) (async) sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0x4}, {}, {0xffe0, 0xf}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x41d808}]}}]}, 0x3c}}, 0x20040054) (async) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100003800c"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000240)={'sit0\x00', &(0x7f0000000180)={'syztnl2\x00', 0x0, 0x8, 0x1, 0x4, 0x200, {{0x1b, 0x4, 0x2, 0x2d, 0x6c, 0x68, 0x0, 0xff, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x2c}, @rand_addr=0x64010101, {[@noop, @noop, @generic={0x94, 0x6, "e4f465bc"}, @noop, @timestamp_prespec={0x44, 0x14, 0x26, 0x3, 0x2, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3}, {@multicast1, 0x1000}]}, @timestamp_prespec={0x44, 0x1c, 0x7b, 0x3, 0x6, [{@multicast2, 0x6}, {@private=0xa010102, 0x5}, {@loopback, 0x3}]}, @end, @timestamp_addr={0x44, 0x1c, 0x8f, 0x1, 0x9, [{@broadcast, 0x2}, {@rand_addr=0x64010102, 0x56b5c0c0}, {@local, 0x9}]}]}}}}}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x60, 0x10, 0x401, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2201, 0x20042}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @sit={{0x8}, {0x34, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r7}, @IFLA_IPTUN_FLAGS={0x6, 0x8, 0x36}, @IFLA_IPTUN_6RD_PREFIXLEN={0x6, 0xd, 0x8}, @IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x1}, @IFLA_IPTUN_ENCAP_FLAGS={0x6, 0x10, 0x3e}, @IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x1}]}}}]}, 0x60}}, 0x4040000) 1.246365651s ago: executing program 4 (id=16374): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000000140)=0x40, 0x4) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/62, 0x328000, 0x800, 0x9, 0x3}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f00000000c0)=0x800, 0x4) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000300)=0x2, 0x4) bind$xdp(r3, &(0x7f0000000100)={0x2c, 0x0, r4}, 0x10) bind$xdp(r2, &(0x7f0000000240)={0x2c, 0x1, r4, 0x0, r3}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="4c00000068000301000000ef00000000000000000000000006000300000000000800010000000000240002000200000000000000000000000000000001"], 0x4c}}, 0x0) 1.130030108s ago: executing program 0 (id=16375): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_MPATH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r1, 0x1, 0x70bd25, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x44000) 975.716993ms ago: executing program 0 (id=16376): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r1, 0x1, 0x2b, &(0x7f00000001c0), 0x4) (async) setsockopt$sock_int(r1, 0x1, 0x2b, &(0x7f00000001c0), 0x4) setsockopt$inet_int(r1, 0x0, 0x1, &(0x7f0000000000)=0xff, 0x4) (async) setsockopt$inet_int(r1, 0x0, 0x1, &(0x7f0000000000)=0xff, 0x4) bind$inet(r1, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) (async) bind$inet(r1, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000000)=0x1, 0x4) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000005280), 0x1, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r3, &(0x7f0000002080)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) listen(r3, 0xa) (async) listen(r3, 0xa) connect$bt_l2cap(r3, &(0x7f00000000c0)={0x1f, 0x80, @any, 0x0, 0x2}, 0xe) (async) connect$bt_l2cap(r3, &(0x7f00000000c0)={0x1f, 0x80, @any, 0x0, 0x2}, 0xe) poll(&(0x7f00000052c0)=[{r2, 0x24}], 0x1, 0x9) (async) poll(&(0x7f00000052c0)=[{r2, 0x24}], 0x1, 0x9) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_FD_TO_HANDLE(r4, 0xc038586a, &(0x7f00000001c0)={r4, &(0x7f0000000080)='{\x00', 0x123080, &(0x7f00000000c0)={@_ha_fsid={[0x5, 0x3]}, {0x8000, 0x4006, 0xfffffe01}}, 0x0, &(0x7f0000000140)={@_ha_fsid}, &(0x7f0000000180)=0x7}) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0}}, 0x4040) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000240)=@tcp6}, 0x98) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="3000000041000701fefeffff00000000017c0000040042801400018006000600800a000008001800", @ANYRESOCT=0x0, @ANYRESDEC=r5], 0x30}, 0x1, 0x0, 0x0, 0x48811}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r4) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="40010000", @ANYRES16=r10, @ANYBLOB="01000000000004000000010000002400030000000000000000000000000000000000001000000000000000000000000000001400020077673100000000000000000000000000f400088050000080040009801400040002004e2064010101000000000000000006000500010000000800030002000000240001"], 0x140}, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="10000000040000000800000002"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020205d0af8ff00000000bea100000000000007010000f8ffffffb702000008000000b7030000ffee0000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x74, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r13 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0xd, 0x4, 0x4, 0xc, 0x0, r12}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r13, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NL80211_CMD_SET_TID_CONFIG(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)={0x20, r8, 0x1, 0x70bd2c, 0xffeffffe, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) (async) sendmsg$NL80211_CMD_SET_TID_CONFIG(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)={0x20, r8, 0x1, 0x70bd2c, 0xffeffffe, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NL80211_CMD_UPDATE_FT_IES(r4, &(0x7f0000000480)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r6, 0x2, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r11}, @val={0xc, 0x99, {0xd, 0x42}}}}, [@NL80211_ATTR_IE={0x2e, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @rann={0x7e, 0x15, {{}, 0x1, 0x2a, @broadcast, 0x8, 0x3, 0x5}}, @random={0x2f, 0x9, "da7fad3450ae73a40b"}]}, @NL80211_ATTR_MDID={0x6, 0xb1, 0x4}, @NL80211_ATTR_IE={0x4}]}, 0x64}, 0x1, 0x0, 0x0, 0x24000000}, 0x40080) (async) sendmsg$NL80211_CMD_UPDATE_FT_IES(r4, &(0x7f0000000480)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, r6, 0x2, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r11}, @val={0xc, 0x99, {0xd, 0x42}}}}, [@NL80211_ATTR_IE={0x2e, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @rann={0x7e, 0x15, {{}, 0x1, 0x2a, @broadcast, 0x8, 0x3, 0x5}}, @random={0x2f, 0x9, "da7fad3450ae73a40b"}]}, @NL80211_ATTR_MDID={0x6, 0xb1, 0x4}, @NL80211_ATTR_IE={0x4}]}, 0x64}, 0x1, 0x0, 0x0, 0x24000000}, 0x40080) 975.538615ms ago: executing program 3 (id=16377): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000000000000000ac1e0001821501f63ed02a170000000000000000000000000a0060"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000000000000000080ffffff000000fc00000000000000000000000000000000000000000000000a003000"], 0xb8}}, 0x4000) 872.575523ms ago: executing program 3 (id=16378): r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000007000000000000000000000071122e0000002744f2ed0000950000000000000090e5f3a76d11fc6a7c4a0505fd8cdf022a1694f9dbd7fc5cf38e36d97ca0bf6827bcc2ae16aa617eec94dd70f5df0c5487327060a940423118d5d1e9a7b6c97f4c255eb607ed5f07858179f7c2dfd69ca037b71ed8ec52e56e5b7095454b4dec4617b0f0ef8dd308eee2d27b6a41e3dd0b7627c7f8eac735d41913cde4fd903402e41c40f4e68cc79659e9c3f72109b25545fbb90dc8dd9bc771f6b71d0f8ee714a900a42aac788c74bef8fc8e0ca2364591b9f8e08859e923c43ed45551b49ba87f1209d45ae163fd3f755a39cad615073005b333"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) getsockopt$X25_QBITINCL(r2, 0x106, 0x1, 0x0, &(0x7f0000000280)) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {}, {0x3, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x4, 0x9, 0x2}}]}}]}, 0x44}}, 0x0) socket(0x10, 0x3, 0x0) (async) socket$packet(0x11, 0x2, 0x300) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000007000000000000000000000071122e0000002744f2ed0000950000000000000090e5f3a76d11fc6a7c4a0505fd8cdf022a1694f9dbd7fc5cf38e36d97ca0bf6827bcc2ae16aa617eec94dd70f5df0c5487327060a940423118d5d1e9a7b6c97f4c255eb607ed5f07858179f7c2dfd69ca037b71ed8ec52e56e5b7095454b4dec4617b0f0ef8dd308eee2d27b6a41e3dd0b7627c7f8eac735d41913cde4fd903402e41c40f4e68cc79659e9c3f72109b25545fbb90dc8dd9bc771f6b71d0f8ee714a900a42aac788c74bef8fc8e0ca2364591b9f8e08859e923c43ed45551b49ba87f1209d45ae163fd3f755a39cad615073005b333"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) getsockopt$X25_QBITINCL(r2, 0x106, 0x1, 0x0, &(0x7f0000000280)) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) (async) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {}, {0x3, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x4, 0x9, 0x2}}]}}]}, 0x44}}, 0x0) (async) 758.269598ms ago: executing program 0 (id=16379): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xe, 0x3, 0x1, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x51}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000700)=@newqdisc={0x170, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x8, 0x5, 0x400, 0x9, 0x81, 0x101, 0x86a4, 0xc40, 0x7fffffff, 0xfffffffd, 0x1, 0xb, 0x16, 0x0, 0xca11, 0xffff}}, @TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e01798d28b6d63cf7465ea95bd97b018b7afaccdcb0000000000000009e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236743acdf902703c7bd07f2df5989ee40e409b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ffcf44f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990f7acfdb8216ea52f604b9f12033688caa4b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d6"}]}}]}, 0x170}, 0x1, 0x0, 0x0, 0x845}, 0x24008004) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000d, 0x4008031, 0xffffffffffffffff, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e21, @multicast1}, 0x2, 0x0, 0x0, 0x1}}, 0x26) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000000)=r5, 0x2) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xb, 0x4, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x4c}, [@call={0x85, 0x0, 0x0, 0x1c}]}, &(0x7f0000000000)='GPL\x00'}, 0x80) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000100)=@phonet={0x23, 0x0, 0x0, 0x37}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000240)="2705020059feff000600002fb96dbcf706e10500070088a800008100accb", 0x1e}, {&(0x7f00000002c0)}, {&(0x7f00000005c0)="ac3788481e439e19a3fab5e73acb3e944e5067314670e86878ea780b34a68a9f01b15a9ff9522b89b6c88218d5f257529aa4e34fab88a671ab48b27ac6a4207fe8a270d3d5b82f100a392980a058dddf565e7deaddd88af7ee746b611a2c5033762a03a3b3e135cf3e1b253385ed8c0de1a820324943afbf72b1509334a4815debe79c5d881fe356404ebd716994cc31b9279965133894ceca066cba08977bfd328ee08749c20449017c661b7cfb27f29f4c2a5ef569403ee926899deada9ab15aba6b7054dc68cf2a65ca130aa11ca288230c24a6f2cd9a865615ce0bdeceb0d07f6a9b693d9aea5629b7578a843b98a8", 0xf1}], 0x3}, 0x0) 648.206785ms ago: executing program 4 (id=16380): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a030000000000fffffff5010000000900010073797a300000000048000000160a010200000000000000153d99c60a618a9c0073797a30000000000900020073797a3000000000140003800800024000000000080001400000000008000740000000015c000000160a01010000000000000000010000000900020073797a30000000000900010073797a3000000000300003"], 0xec}}, 0x0) 579.890694ms ago: executing program 2 (id=16381): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000ec0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8000}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0xf6}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x5}, @NFTA_BITWISE_DATA={0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x10c}}, 0x0) (async) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000040)={0x1b, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x149e, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x2, 0x4}, 0x50) (async) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000000200)={r0, &(0x7f0000000100)='{\x00', 0x400800, &(0x7f0000000140)={@_ha_fsid={[0x0, 0x7fff]}, {0x7, 0xfffc, 0x0, 0x4}}, 0x401b, &(0x7f0000000180), &(0x7f00000001c0)=0xa}) r3 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000240)={0x0, 0x1cd, 0x18}, 0xc) (async, rerun: 32) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000400), 0x4) (async, rerun: 32) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r5, &(0x7f0000000700)=[{&(0x7f00000000c0)="02ef667db5e53f90ddf725d589e79497ed32000192c55934a92b7b6285d5b1fb065ae78c91902eb69b165687a415b833508dc85680407417b65a83592a4e597178233649c148ab68571c3390210cbe7ea8194c25e9b37c83bb8055e08218fa6a47d9401cdffa24dd9b984cec90c7c1508f05453927e13e43ffc2f4482bd0fc", 0x4}, {&(0x7f0000000140)="1a36c585040053c08764d056a86d003cbaf5cde47e5f51052d82c19aa673d661416429534237090097b3116d403a08c07bbbe72da665341d6592092455897fe84a54e94a435e8d3810ce4899d5b04d17b099bbec7fb7f005b03bb00f6860f0cd665a14bd1b7ad319101e9beae62faa71a5f2383e963aba417592d7a84958", 0x7e}], 0x62) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r5, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x10001, 0x49, 0x1}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r6, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r6}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)={0x1b, 0x0, 0x0, 0x4, 0x0, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x3, 0x2}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x22, &(0x7f0000000280)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@map_fd={0x18, 0x8, 0x1, 0x0, r2}, @printk={@lld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}}, @call={0x85, 0x0, 0x0, 0x81}, @jmp={0x5, 0x0, 0x7, 0xe, 0x0, 0x40, 0xfffffffffffffffc}, @map_idx={0x18, 0x0, 0x5, 0x0, 0x8}, @alu={0x4, 0x1, 0x2, 0x4, 0x1, 0x4, 0xfffffffffffffff0}, @map_val={0x18, 0x4, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x5}, @initr0={0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xf312}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000003c0)='syzkaller\x00', 0x2, 0x0, 0x0, 0x60600, 0x50, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000000440)={0x8, 0x4}, 0x8, 0x10, &(0x7f0000000480)={0x5, 0x9, 0x81, 0x80000000}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000540)=[r5, r6, r7], 0x0, 0x10, 0xfffff000}, 0x94) 544.618357ms ago: executing program 4 (id=16382): connect$inet(0xffffffffffffffff, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(0xffffffffffffffff, 0x8) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f00000000c0)={0x0, 0x3ff, 0xc3, "9be0f3de2f8e2d7dc1ab54f9268edd209d83b17a945af27a275e7c489b406f68a6057748bced05defc50209e256408f65cbabbf702c6d0274f64cc73707c7dc378b3f1a51aa199ca207ce0659098ef7ff1e16dce91b873599bd7bea937daafe269366fda5161936a4b9aa9a50545e4383515cca11f2dc628c594a1e63edf86d15d483e418f168db9c4286829a238e734fda8abbd773d780ded20e3b573e332e6a1a5f186433096cad8cc98a5a0000cd8fe0e732c87e05c053b3530f03576eb2a36634f"}, 0xcb) 492.07455ms ago: executing program 3 (id=16383): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002640)=@delchain={0x6ec, 0x65, 0x600, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xfff2}, {0x0, 0x1}, {0xb}}, [@filter_kind_options=@f_bpf={{0x8}, {0x6c0, 0x2, [@TCA_BPF_ACT={0x6bc, 0x1, [@m_xt={0x254, 0x5, 0x0, 0x0, {{0x7}, {0x4}, {0x22c, 0x6, "a5fd64840366fd7ad44f3f053221ded9ced495590e2bc8690a2765e56ded8425cb3eb0e04bbcfec50e639bf373167e617b24eccd260f28bb850873b1e2154b158987d6e585e10ffeaba32641bae47de041e1169d8e4a65b8ce3633a4469c93c5228320c572237d92a9ae6bbcad2b22629cd3a2d1e27de283017ecf9fca6b2cd8a119dee59702830717b694625f60f5c81f688775c5e292f76a0ffa39e1d2cabd639d1c111c01e0d2f9faa2201545d52ba5a7f6203501c1b6e5ed59d5c5e88c16e1992860c3756adec4020000000229d6fa3a66f73c6661019d2f7fabbfcada2dcccbe950dc830c028cf5d38ff42172775c60eebc64519be9f951446a4f4c33700ca5ec355793499317533326357a45799d285c59d3c446641dc16418f349c1ff505ee55d27086e341db0c6fbfe224cefcbffca74355e8a64a7f1fc05d243a881d66ecf331426581b2886e9e8eea9040f6b145f192ef8790a765fcf267c52fe535df2de0609fa14245a38f5652e4bc99b6939df37bb979dcc0ee23351fa3acfd5751aeeb3635dfbba5b15bf782bac480aba99f63dabbee4af017fb5aab070597ab91cca6feb68244c8830bebdb9078602145e1d0e171ac77babfdd4e4de8a8fd25495794a69aeb0a408280de7421469b58ba458032f3d671aa54c7148370fa792b6fb3ec5e4dbc7d9db46ecdacaa07c4c479e2a99994f4a7ff9e313bc467a4123cef24d11227859c5b98035fa1cb27bb29357393e099a6a9afd18ca315bd5a6edb81ae5f59f2f5be3"}, {0xc, 0x7, {0x1, 0xeb0757422c733451}}, {0xc, 0x8, {0x0, 0x2}}}}, @m_skbmod={0x1b4, 0x0, 0x0, 0x0, {{0xb}, {0xbc, 0x2, 0x0, 0x1, [@TCA_SKBMOD_DMAC={0xa, 0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x4, 0xe27, 0x10000000, 0x5, 0x1}, 0xf}}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x5, 0x2, 0xfffffffffffffffd, 0x5, 0x400}, 0x2000000000a}}, @TCA_SKBMOD_DMAC={0xa, 0x3, @local}, @TCA_SKBMOD_DMAC={0xa, 0x3, @local}, @TCA_SKBMOD_DMAC={0xa, 0x3, @remote}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x6, 0x3, 0x20000000, 0x3, 0x9}, 0xf}}, @TCA_SKBMOD_SMAC={0xa, 0x4, @multicast}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0xf7e5}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x7}]}, {0xce, 0x6, "a1b660f5208936232cda86dbc72ce07ea965ef6ba1d1d09844721c7c4a99215f65588f37144130a0cfe892f40c7bd1b1c60c0ae07d055bb7d54c8481900754b36455377c7ddafad62bd905b87e203cd85441766254f1fb76d106fc2ab3b535bd37b963914a3937078f08fe2b215c53ac1637586d19d3179be2480bd4560f5f3df8af92646dcc1fbd383420085b4c07db2f0413025ad48ce3b346d0decc2020a76819621adf129187c02cc25e2c07331a44b29b6bee81ecbc147aa5d146be79432192fc1574145998b7d3"}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}, @m_bpf={0x50, 0x8, 0x0, 0x0, {{0x8}, {0x28, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x101, 0xfffffff7, 0xffffffffcffffffd, 0x1, 0x2}}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_nat={0x1bc, 0x4, 0x0, 0x0, {{0x8}, {0x194, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0xab7, 0x4c1adacc, 0x5, 0x99, 0x6}, @empty, @local, 0x0, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x4, 0x401, 0x5, 0x6, 0x5}, @rand_addr=0x64010102, @multicast1, 0xff}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x1, 0x5, 0x5, 0x7, 0xd}, @loopback, @empty, 0xffffff00, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x4ef0, 0x1, 0x2, 0x10001, 0xc0e}, @multicast1, @rand_addr=0x64010100, 0xff000000, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x80000000, 0x1, 0x3, 0xfd30, 0x1}, @dev={0xac, 0x14, 0x14, 0x41}, @local, 0xff, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x2, 0x11d, 0x5, 0x3, 0x1}, @multicast1, @empty, 0xff000000}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x5, 0xffffff7f, 0x5, 0x79, 0x74e69dde}, @local, @rand_addr=0x64010100, 0xffffffff, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0xffff000, 0x2cf, 0xffffffffffffffff, 0x1, 0xd}, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote, 0xff000000, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x10, 0x8, 0x10000000, 0x1ff, 0x2}, @local, @broadcast, 0xffffff00}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x1, 0x1, 0xffffffffffffffff, 0x6, 0xd}, @empty, @dev={0xac, 0x14, 0x14, 0x26}}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_connmark={0xa4, 0x9, 0x0, 0x0, {{0xd}, {0x74, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1ff, 0x5, 0x7, 0x1, 0x1e1c}, 0x5}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xd784, 0x468, 0x20000000, 0x9, 0x4}, 0x2}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x0, 0x4, 0x5, 0x8, 0x2}, 0x5}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x4, 0x2, 0x3, 0x6, 0x6a}, 0x80}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}]}}]}, 0x6ec}, 0x1, 0x0, 0x0, 0x2404c080}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000180)=@ethtool_drvinfo={0x3, "55c926d748e9219f0595ad24890a6a15b2d52368edf173313fe245fb5ed9af9e", "fc3ebcf63a94a908599549df41158f149c5e1ce4e2082ab95ca423907d3ef289", "11c948cbc903529e681aca17173ac072b9b50f709829a5ec17155fe68a6829dd", "fede46b54094378d3bbcaaebcd42971817a4c31e9ec87f80b16012641e0dce25", "37ad975abe70c433906fdf7d67be68e374ec371af7752d9fb41a35fb9f55f0b5", "93479de76a07e7caf29fc22b", 0x7, 0x404, 0x7f, 0x5d46, 0x6}}) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 481.639028ms ago: executing program 2 (id=16384): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYBLOB='\b'], 0x40}}, 0x0) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) (async, rerun: 64) r2 = socket(0x400000000010, 0x3, 0x0) (async, rerun: 64) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) (async) r5 = socket(0x15, 0x5, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x0, &(0x7f00000004c0)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) (async) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000940)=@newtfilter={0x128, 0x2c, 0xd27, 0x70bd25, 0xa000, {0x0, 0x0, 0x0, r4, {0xe, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0xf8, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x8, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x1c, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x49}]}]}, @TCA_FLOWER_KEY_ICMPV6_TYPE_MASK={0x5}, @TCA_FLOWER_KEY_ENC_OPTS_MASK={0xac, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x3c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x3000000}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xc00}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xff}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5ac}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x4}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x2c, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x5}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x1}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x24, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_DIR={0x5, 0x3, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x7fffffff}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0xc, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0xb5}]}]}, @TCA_FLOWER_KEY_ARP_THA={0xa, 0x41, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x37}}, @TCA_FLOWER_KEY_TCP_SRC={0x6}, @TCA_FLOWER_KEY_ENC_IPV4_SRC={0x8, 0x1b, @local}]}}]}, 0x128}, 0x1, 0x0, 0x0, 0x80}, 0x0) connect$pppl2tp(r0, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x3, 0x1, 0x1, 0x1, {0xa, 0x4e24, 0x7, @remote, 0xf}}}, 0x3a) 370.669377ms ago: executing program 4 (id=16385): r0 = socket$inet(0x2, 0x6, 0x5) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000000)) setsockopt$inet_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000040)=@gcm_256={{0x303}, "f73daafbfe1a7254", "39bf086f36cf00d68980c72008d74a48dc9b220459211ab617209de8ef7ce3d8", "f0c948aa", "c555272aac8f002e"}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f00000000c0)={0x0, 0xe}, 0x8) ioctl$INCFS_IOC_FILL_BLOCKS(r0, 0x80106720, &(0x7f0000000340)={0x3, &(0x7f00000002c0)=[{0x100, 0x8, &(0x7f0000000100)="cd4aa675aadd5af8", 0x1, 0x1}, {0x839e, 0xe4, &(0x7f0000000140)="4092358f014516dea03dcff69a2691842f93fe185370f54ad59c5ed7be0281e5cc773b2e0f7d1c42fc00c5dd69532f2aac3087e19fee3ef4830c133b20a33bac4f2318fc6bb189407835658b70aa99a94fe524d9caf8d59aba4f23a7e65ebc14f025ddc626c6d9baacefedcd062f2a1bf8ce5f448548754ac70fe7b4f3369a198529bdcdc12c0f6e6f30aaddf3aacac4556b2f7b598a74ecd3f36267d7b990096e9d7df5693986851cee8575f53cf8c5efd627d430e5849b00bd2bd8c6c1183c6d88b496fcc8db448e164923efc10a01bf5d92960c6c56fcc0f558b4c72d125c9bae186c", 0x1, 0x1}, {0x2, 0x52, &(0x7f0000000240)="31bfae675d2124a077c3fe0b1b2b3a201a71623e29d51e1db171af4a7ca8c852965dbe67c716d11a95da5b481a9e8e94e01a5f8fe0c7cc1c09d8301d2c65eee3f475c46e84b0693ed60d32ec30ea07560e08", 0x1, 0x1}]}) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r0, 0x6628) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f00000003c0)=@buf={0x39, &(0x7f0000000380)="a8d58061cb5416696ac6ce7f92eb14684b35043232523e3efbe2f16fee95d4a774539a2a015983f482ea5ddc406d2425806d11efed5b686ea8"}) recvmsg(r0, &(0x7f0000000a00)={&(0x7f0000000400)=@vsock={0x28, 0x0, 0x0, @hyper}, 0x80, &(0x7f0000000880)=[{&(0x7f0000000480)=""/65, 0x41}, {&(0x7f0000000500)=""/57, 0x39}, {&(0x7f0000000540)=""/63, 0x3f}, {&(0x7f0000000580)=""/170, 0xaa}, {&(0x7f0000000640)=""/74, 0x4a}, {&(0x7f00000006c0)=""/137, 0x89}, {&(0x7f0000000780)=""/34, 0x22}, {&(0x7f00000007c0)=""/133, 0x85}], 0x8, &(0x7f0000000900)=""/193, 0xc1}, 0x102) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000f40)={{r0, &(0x7f0000000a40)='team0\x00', 0x0, &(0x7f0000000a80)={@_ha_fsid={[0x10, 0x400]}, {0x81, 0x6, 0x2, 0x5}}, 0x9, &(0x7f0000000ac0), &(0x7f0000000b00)=0x67}, 0x4, &(0x7f0000000ec0)=[{0x2, 0x1, &(0x7f0000000b40)='team0\x00', &(0x7f0000000b80)="3055aab115d21b674a808d412ee2e06f107fc5fd174be522b1ecde03e105354818ea0d2d0a5eee2292f85c85ebc1bf6ae42f8ec336f514cf809ffae739f88f437d495c17a6564855321c674bc26ce3ebae5b7fb61c09adb269", 0x59}, {0x3, 0x4, &(0x7f0000000c00)='team0\x00', &(0x7f0000000c40)="34c3703242b06f803afca7ced941c5ff53a4db7bcaf09877788efe99fde3a8d075a4860d5b9fe5a8e6ddf94775d2bee0cb4f387f76271f981991c6ca1f30db53c6898865951168ae3634b5f0ac98b02b460c213ce267e1f240d8322c18a2a1563358ee109fa5dd9f32032c1505f207266b81f750f1db126876195ffe56920cf1a48824d9f4ed1516e0be2e523e4383ab286b4c3edfa15e4b786e335ea767545593be7c513717578ee8469fcda1d6dc1c27a812244e9b38dc2f06d87ac4445e42bd60044a8f4cb4c36e4ad0fa2b537630b45b4b8e459a281d8c09cf0587340030fabbbf14589c37b9199c670e8856a1c4fefa6ffda881d4aa01", 0xf9, 0x2}, {0x2, 0x4, &(0x7f0000000d40)='team0\x00', &(0x7f0000000d80)="2e7e6fb29a5f23a664a7061ff331a33a7ddc0c2ef5ea5bfae9848168eac791db27746e", 0x23, 0x32}, {0x2, 0xb1b, &(0x7f0000000dc0)='(Y,\x00', &(0x7f0000000e00)="bab7d44f649028a4a486813f247ee0362295655c63dc9eb4729a3cc822c44447db6c07138633ee08543b3c6f713a122d269af03a540c9952311d9568709c43f66f69e9775ade036496d74e91c06d20c86baa871a2796f0939f65e4158386d69bf52068da2b102159e70b02edf2e3fc4064c3ca3e5edac685b2f7ac7a48eaa1ebb8d92110856b4b93d785118c0b561e0a0867f411d92612e97542a05a36f8b5f60e91a2f5670ec34e7ce0a3bdeb458b3c9de088f0e52ac77d8d60769a", 0xbc}]}) getsockopt$inet_mreqsrc(r2, 0x0, 0x28, &(0x7f0000000fc0)={@local, @dev, @multicast2}, &(0x7f0000001000)=0xc) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001080), r2) getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f00000010c0)=0x0, &(0x7f0000001100)=0x4) sendmsg$MPTCP_PM_CMD_REMOVE(r3, &(0x7f0000001280)={&(0x7f0000001040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001240)={&(0x7f0000001140)={0xcc, r4, 0x0, 0x70bd2d, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r5}]}, @MPTCP_PM_ATTR_ADDR={0x4c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r1}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x1000}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x24, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x10}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x4004080}, 0x0) sendmsg$NFNL_MSG_CTHELPER_GET(r2, &(0x7f0000001400)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000013c0)={&(0x7f0000001300)={0xb4, 0x1, 0x9, 0x201, 0x0, 0x0, {0x3, 0x0, 0x4}, [@NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x5}}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0xf}, @NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}, @NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x1a}, @NFCTH_TUPLE={0x30, 0x2, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}]}, @NFCTH_TUPLE={0x44, 0x2, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x10}, 0x801) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000001700)={0xc, 0x1b, &(0x7f0000001440)=@raw=[@printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}}, @ldst={0x2, 0x2, 0x3, 0x0, 0x5, 0x4, 0x4}, @map_idx_val={0x18, 0x0, 0x6, 0x0, 0x3, 0x0, 0x0, 0x0, 0x630}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xf}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @alu={0x4, 0x0, 0xa, 0xb, 0x0, 0x4, 0x8}, @exit, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}], &(0x7f0000001540)='syzkaller\x00', 0x2, 0x0, 0x0, 0x82100, 0x21, '\x00', r1, @fallback=0x18, r2, 0x8, &(0x7f0000001580)={0x9, 0x3}, 0x8, 0x10, &(0x7f00000015c0)={0x2, 0x5, 0xffffff7f, 0x4}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, &(0x7f0000001600)=[r2], &(0x7f0000001640)=[{0x0, 0x4, 0xf, 0x6}, {0x1, 0x1, 0x1, 0x1}, {0x2, 0x5, 0x6}, {0x2, 0x4, 0x4, 0x7}, {0x4, 0x5, 0x2, 0x6}, {0x1, 0x3, 0xb, 0xc}, {0x4, 0x4, 0x1, 0x7}, {0x1, 0x1, 0x5, 0x1}, {0x5, 0x3, 0xc, 0x6}, {0x0, 0x2, 0x6, 0x2}], 0x10, 0x101}, 0x94) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f00000017c0)={0x0, 0x8, 0x9, [0x4, 0x6, 0x340c, 0x4, 0x7, 0x6, 0x3, 0x101, 0x6]}, &(0x7f0000001800)=0x1a) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000001840)={r7}, &(0x7f0000001880)=0x8) getsockopt$inet_sctp_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f00000018c0)=@assoc_id=r8, &(0x7f0000001900)=0x4) r9 = openat$nci(0xffffffffffffff9c, &(0x7f0000001940), 0x2, 0x0) write(r9, &(0x7f0000001980)="37b901b22ef8ba228988afa3361ccfb2ab7e395c74dc711e0dda52a1334d968c7e13c1deecb6a7a12f5845b4defc2eee74530cfa301443698efb3b8392981414b04700c58a8ed50a8ebf99c6b4fe0f15bcabb4f573e02abb9bd9e8cbbcea1c4fc0610df6809b8f8523b1257e9e6e5d4f54a14ba94fc04da63062df821d3d3d659df4dcd0222ebbe5cda0825d7900b5486def377d9f7357f72d79b0dc46e962744c94d3e6788d05e494dfbdfed64d580ab58d0836cbd788f3692984e76cba012562d11ee54e9c2d42e81566754a076d4b618cf6f9a7e10ba4ff5a9241392ec716bb3d7a560107d1b9d34885d92ff6b36a1b841d28d6f32f0f58ff64a6da", 0xfd) bind$inet(r0, &(0x7f0000001a80)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x34}}, 0x10) ioctl$FS_IOC_SETVERSION(r6, 0x40087602, &(0x7f0000001ac0)=0x5) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001b40), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000001b80)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000001c40)={&(0x7f0000001b00)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x20, r10, 0x200, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_SOCKET_OWNER={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000010}, 0x80) ioctl$XFS_IOC_FSBULKSTAT_SINGLE(r6, 0xc0205866, &(0x7f0000001dc0)={&(0x7f0000001c80)=0xff, 0xa, &(0x7f0000001cc0)=[{}], &(0x7f0000001d80)}) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r12, &(0x7f0000001f40)={&(0x7f0000001e00)={0x10, 0x0, 0x0, 0x80002409}, 0xc, &(0x7f0000001f00)={&(0x7f0000001ec0)={0x28, 0x0, 0x800, 0x70bd28, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x28}, 0x1, 0x0, 0x0, 0x8094}, 0x4000) 224.087267ms ago: executing program 1 (id=16386): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_DELFLOWTABLE={0x20, 0x18, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x84, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x5c, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x24, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x11}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0xa}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xf8}, 0x1, 0xa00000000000000}, 0x6004014) sendmsg$TIPC_NL_MEDIA_SET(0xffffffffffffffff, 0x0, 0x2000) 218.948346ms ago: executing program 3 (id=16387): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) (async) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f00000003c0)=0x1, 0x4) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async) sendto$inet(r2, &(0x7f0000000380)='g', 0x1, 0x8812, 0x0, 0x0) (async, rerun: 64) recvmmsg(r2, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000002c0)=""/131, 0x83}], 0x1}, 0x2}], 0x1, 0x10122, 0x0) (async, rerun: 64) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r3, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 32) recvmsg(r0, &(0x7f0000000d00)={&(0x7f00000005c0)=@x25, 0x80, &(0x7f0000000c80)=[{&(0x7f0000000640)=""/52, 0x34}, {&(0x7f00000007c0)=""/200, 0xc8}, {&(0x7f00000008c0)=""/31, 0x1f}, {&(0x7f0000000900)=""/183, 0xb7}, {&(0x7f00000009c0)=""/186, 0xba}, {&(0x7f0000000a80)=""/249, 0xf9}, {&(0x7f0000000c00)=""/116, 0x74}], 0x7}, 0x10003) (async, rerun: 32) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000780)={'netdevsim0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x8}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x8}]}, 0x40}}, 0x8000) ioctl$F2FS_IOC_DEFRAGMENT(r5, 0xc010f508, &(0x7f0000000000)={0x4, 0x6}) 148.208801ms ago: executing program 2 (id=16388): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000000000000000ac1e0001821501f63ed02a170000000000000000000000000a0060"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000000000000000000300000000000fc00000000000000000000000000000000000000000000000a003000"], 0xb8}}, 0x4000) 107.966986ms ago: executing program 1 (id=16389): syz_emit_ethernet(0x0, 0x0, 0x0) r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x271b, &(0x7f0000000080)=""/102382, &(0x7f0000000040)=0x18fee) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) (async) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x3f, &(0x7f0000000000)=0x40, 0x4) 0s ago: executing program 2 (id=16390): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="80000000", @ANYRES16=r1, @ANYBLOB="050000000000000000000200000008000300", @ANYRES32=r2, @ANYBLOB="2d000e0080000000ffffffffffff08021100000008021100000000000000000300000000640000002503000000000000080026006c09"], 0x80}}, 0x0) kernel console output (not intermixed with test programs): 0002e [ 1514.676360][T19658] RAX: ffffffffffffffda RBX: 00007f0700825fa0 RCX: 00007f070059de59 [ 1514.676375][T19658] RDX: 0000000024000010 RSI: 0000200000000ac0 RDI: 0000000000000004 [ 1514.676389][T19658] RBP: 00007f0701437090 R08: 0000000000000000 R09: 0000000000000000 [ 1514.676401][T19658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1514.676413][T19658] R13: 00007f0700826038 R14: 00007f0700825fa0 R15: 00007ffe70f991b8 [ 1514.676444][T19658] [ 1514.894907][T19613] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1514.905770][T19613] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1515.096792][T19613] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1515.107075][T19613] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1515.194235][T19676] xt_hashlimit: invalid rate [ 1515.232148][T19678] netlink: 'syz.2.14715': attribute type 2 has an invalid length. [ 1515.635259][ T1164] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1515.643758][ T1164] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1515.767425][ T4318] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1515.776100][ T4318] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1515.786095][ T4318] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1515.794477][ T4318] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1515.901402][ T4318] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1515.909631][ T4318] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1516.341190][T19740] __nla_validate_parse: 20 callbacks suppressed [ 1516.341207][T19740] netlink: 24 bytes leftover after parsing attributes in process `syz.0.14735'. [ 1518.877907][ T4318] net_ratelimit: 126 callbacks suppressed [ 1518.877958][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1518.955553][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1518.996335][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1519.022962][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1519.138058][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1519.163550][ T4316] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1519.193431][ T62] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1519.334761][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1519.447337][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1519.551964][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1521.226295][T19787] netlink: 28 bytes leftover after parsing attributes in process `syz.1.14754'. [ 1523.892292][ T4313] net_ratelimit: 105 callbacks suppressed [ 1523.892312][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1523.940553][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1523.968504][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1524.007997][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1524.034227][ T4312] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1524.073118][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1524.101797][ T4312] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1524.127037][ T62] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1524.151786][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1524.179231][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1526.217176][T19862] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14778'. [ 1526.497154][T19882] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14784'. [ 1526.507659][T19882] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14784'. [ 1526.527431][T19882] macsec1: entered promiscuous mode [ 1526.538219][T19884] sctp: [Deprecated]: syz.3.14785 (pid 19884) Use of int in maxseg socket option. [ 1526.538219][T19884] Use struct sctp_assoc_value instead [ 1526.590441][T19886] validate_nla: 3 callbacks suppressed [ 1526.590461][T19886] netlink: 'syz.0.14786': attribute type 4 has an invalid length. [ 1527.098046][T19910] syzkaller0: entered promiscuous mode [ 1527.103576][T19910] syzkaller0: entered allmulticast mode [ 1527.285099][T19925] tc_dump_action: action bad kind [ 1528.018363][T19960] sctp: [Deprecated]: syz.2.14807 (pid 19960) Use of int in max_burst socket option deprecated. [ 1528.018363][T19960] Use struct sctp_assoc_value instead [ 1528.044137][T19965] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14811'. [ 1528.364014][T19986] netlink: 224 bytes leftover after parsing attributes in process `syz.1.14816'. [ 1528.669826][T20000] x_tables: duplicate underflow at hook 1 [ 1528.805319][T20000] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 1528.962262][ T4316] net_ratelimit: 85 callbacks suppressed [ 1528.962282][ T4316] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1529.041371][ T4316] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1529.058595][T20023] netlink: 12 bytes leftover after parsing attributes in process `syz.2.14825'. [ 1529.120888][T20027] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1529.141457][ T4316] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1529.153807][ T4316] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1529.241805][ T4317] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1529.249669][ T4317] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1529.398497][T20050] xt_ipcomp: unknown flags 1D [ 1529.410058][ T4312] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1529.422487][ T4312] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1529.465444][T20053] netlink: 'syz.1.14836': attribute type 10 has an invalid length. [ 1529.521430][ T4312] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1529.659618][T20063] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14837'. [ 1529.753970][T20072] netlink: 'syz.2.14840': attribute type 29 has an invalid length. [ 1529.762177][T20072] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14840'. [ 1529.787719][T20072] netlink: 'syz.2.14840': attribute type 29 has an invalid length. [ 1529.798115][T20072] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14840'. [ 1530.356965][T20094] netlink: 44 bytes leftover after parsing attributes in process `syz.0.14847'. [ 1531.278870][T20134] netlink: 16 bytes leftover after parsing attributes in process `syz.1.14858'. [ 1531.396558][T20138] netlink: 12 bytes leftover after parsing attributes in process `syz.1.14860'. [ 1532.503642][T20056] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1532.726738][T20146] FAULT_INJECTION: forcing a failure. [ 1532.726738][T20146] name failslab, interval 1, probability 0, space 0, times 0 [ 1532.751808][T20146] CPU: 0 UID: 0 PID: 20146 Comm: syz.2.14863 Not tainted syzkaller #0 PREEMPT(full) [ 1532.751837][T20146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1532.751849][T20146] Call Trace: [ 1532.751858][T20146] [ 1532.751867][T20146] dump_stack_lvl+0xe8/0x150 [ 1532.751902][T20146] should_fail_ex+0x40c/0x560 [ 1532.751930][T20146] should_failslab+0xa8/0x100 [ 1532.751964][T20146] __kmalloc_noprof+0xfe/0x720 [ 1532.751987][T20146] ? vfs_write+0x22b/0xba0 [ 1532.752015][T20146] ? kernfs_fop_write_iter+0x157/0x540 [ 1532.752034][T20146] ? kernfs_fop_write_iter+0x157/0x540 [ 1532.752062][T20146] kernfs_fop_write_iter+0x157/0x540 [ 1532.752087][T20146] vfs_write+0x612/0xba0 [ 1532.752124][T20146] ? __pfx_vfs_write+0x10/0x10 [ 1532.752162][T20146] ? __fget_files+0x2a/0x420 [ 1532.752197][T20146] ksys_write+0x150/0x270 [ 1532.752228][T20146] ? __pfx_ksys_write+0x10/0x10 [ 1532.752266][T20146] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1532.752287][T20146] do_syscall_64+0x174/0x580 [ 1532.752313][T20146] ? trace_irq_disable+0x3b/0x140 [ 1532.752338][T20146] ? clear_bhb_loop+0x40/0x90 [ 1532.752363][T20146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1532.752383][T20146] RIP: 0033:0x7f6649f9de59 [ 1532.752401][T20146] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1532.752419][T20146] RSP: 002b:00007f66481f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1532.752440][T20146] RAX: ffffffffffffffda RBX: 00007f664a225fa0 RCX: 00007f6649f9de59 [ 1532.752454][T20146] RDX: 0000000000000009 RSI: 0000200000000180 RDI: 0000000000000004 [ 1532.752467][T20146] RBP: 00007f66481f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1532.752479][T20146] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1532.752491][T20146] R13: 00007f664a226038 R14: 00007f664a225fa0 R15: 00007ffe8cf49bc8 [ 1532.752525][T20146] [ 1533.098505][T20156] netlink: 16 bytes leftover after parsing attributes in process `syz.3.14869'. [ 1533.339787][T20166] syzkaller0: entered promiscuous mode [ 1533.361946][T20166] syzkaller0: entered allmulticast mode [ 1533.821583][T20197] netlink: 16 bytes leftover after parsing attributes in process `syz.0.14882'. [ 1533.932209][T20206] siw: device registration error -23 [ 1534.002743][ T4312] net_ratelimit: 78 callbacks suppressed [ 1534.002764][ T4312] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1534.039564][ T4312] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1534.061229][T20214] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14889'. [ 1534.139139][T20219] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14891'. [ 1534.170066][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1534.170825][T20214] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14889'. [ 1534.177869][ T4313] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1534.200106][T20220] mac80211_hwsim hwsim92 wlan0: entered promiscuous mode [ 1534.215767][T20220] netlink: 'syz.3.14890': attribute type 1 has an invalid length. [ 1534.271187][T20225] x_tables: ip6_tables: NETMAP.0 target: invalid size 40 (kernel) != (user) 0 [ 1534.280451][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1534.289135][ T9272] IPVS: starting estimator thread 0... [ 1534.296839][T20220] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1534.304150][T20226] bond6: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 1534.315325][T20226] bond6: entered allmulticast mode [ 1534.330820][T20229] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14894'. [ 1534.377761][ T4317] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1534.396223][ T4317] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1534.412295][T20231] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14895'. [ 1534.421851][T20231] netlink: 24 bytes leftover after parsing attributes in process `syz.3.14895'. [ 1534.432329][T20227] IPVS: using max 27 ests per chain, 64800 per kthread [ 1534.466093][T20235] netlink: 'syz.0.14897': attribute type 2 has an invalid length. [ 1534.494910][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1534.512873][ T4313] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1534.600176][ T4317] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1535.113968][ T29] audit: type=1107 audit(1783504242.010:24): pid=20264 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ً5%UA٠0ltݕ/ 6򊨊' [ 1535.428311][T20287] netlink: 'syz.3.14918': attribute type 4 has an invalid length. [ 1535.451927][T20289] netlink: 'syz.1.14916': attribute type 2 has an invalid length. [ 1535.662574][T20303] syzkaller0: entered promiscuous mode [ 1535.684589][T20303] syzkaller0: entered allmulticast mode [ 1535.689014][T20308] netlink: 'syz.3.14927': attribute type 3 has an invalid length. [ 1535.724858][T20308] netlink: 'syz.3.14927': attribute type 2 has an invalid length. [ 1536.054021][T20328] netlink: 'syz.2.14934': attribute type 2 has an invalid length. [ 1536.200825][T20336] netlink: 'syz.0.14937': attribute type 1 has an invalid length. [ 1536.413376][T20356] sch_fq: defrate 0 ignored. [ 1536.565920][T20356] debugfs: '1^!' already exists in 'ieee80211' [ 1536.620074][T20370] __nla_validate_parse: 9 callbacks suppressed [ 1536.620191][T20370] netlink: 20 bytes leftover after parsing attributes in process `syz.4.14949'. [ 1536.673299][T20356] netlink: 'syz.2.14944': attribute type 49 has an invalid length. [ 1536.737893][T20375] netlink: 312 bytes leftover after parsing attributes in process `syz.1.14947'. [ 1536.947683][T20387] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14958'. [ 1537.071201][T20397] netlink: 12 bytes leftover after parsing attributes in process `syz.2.14959'. [ 1537.081100][T20397] netlink: 12 bytes leftover after parsing attributes in process `syz.2.14959'. [ 1537.171915][T20402] netlink: 20 bytes leftover after parsing attributes in process `syz.3.14962'. [ 1537.405241][T20410] netlink: 'syz.2.14965': attribute type 3 has an invalid length. [ 1537.653891][T20423] netlink: 3 bytes leftover after parsing attributes in process `syz.1.14969'. [ 1537.794877][T20428] netlink: 20 bytes leftover after parsing attributes in process `syz.2.14973'. [ 1537.846897][T20431] syzkaller1: entered promiscuous mode [ 1537.868080][T20431] syzkaller1: entered allmulticast mode [ 1537.894402][T20431] nbd: error processing sock list [ 1538.016772][T20441] netlink: 16 bytes leftover after parsing attributes in process `syz.3.14976'. [ 1538.058480][T20433] macsec1: left promiscuous mode [ 1538.275958][T20453] netlink: 20 bytes leftover after parsing attributes in process `syz.4.14981'. [ 1538.395839][T20463] bond7: (slave sit0): Device is not bonding slave [ 1538.402371][T20463] bond7: option active_slave: invalid value (sit0) [ 1538.410043][T20463] bond7 (unregistering): Released all slaves [ 1538.564113][T20454] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1538.578384][T20454] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1538.619108][T20465] x_tables: duplicate underflow at hook 2 [ 1538.770681][ T4316] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1538.787794][ T4316] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1538.819333][ T4316] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1538.829117][ T4316] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1540.791090][T20431] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1541.368622][T20517] validate_nla: 5 callbacks suppressed [ 1541.368641][T20517] netlink: 'syz.0.15005': attribute type 1 has an invalid length. [ 1541.669543][T20535] __nla_validate_parse: 8 callbacks suppressed [ 1541.669564][T20535] netlink: 240 bytes leftover after parsing attributes in process `syz.1.15006'. [ 1541.719430][T20538] net_ratelimit: 72 callbacks suppressed [ 1541.719448][T20538] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1541.810046][T20546] netlink: 'syz.4.15015': attribute type 2 has an invalid length. [ 1541.930424][T20552] netlink: 'syz.0.15017': attribute type 4 has an invalid length. [ 1542.037593][T20554] netlink: 'syz.1.15019': attribute type 1 has an invalid length. [ 1542.134657][T20554] netlink: 16 bytes leftover after parsing attributes in process `syz.1.15019'. [ 1542.146975][T20570] netlink: 'syz.3.15024': attribute type 30 has an invalid length. [ 1542.162326][T20571] netlink: 'syz.0.15026': attribute type 2 has an invalid length. [ 1542.254969][T20570] bond7: option arp_missed_max: invalid value (0) [ 1542.261630][T20570] bond7: option arp_missed_max: allowed values 1 - 255 [ 1542.272053][T20570] bond7 (unregistering): Released all slaves [ 1542.284424][T20583] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15030'. [ 1542.351576][T20583] netlink: 'syz.2.15030': attribute type 4 has an invalid length. [ 1542.360508][T20574] netlink: 'syz.4.15027': attribute type 10 has an invalid length. [ 1542.385755][T20583] netlink: 'syz.2.15030': attribute type 4 has an invalid length. [ 1542.392234][T20574] 8021q: adding VLAN 0 to HW filter on device team0 [ 1542.402654][T20574] bond0: (slave team0): Enslaving as an active interface with an up link [ 1542.529113][T20593] netlink: zone id is out of range [ 1542.536515][T20593] netlink: zone id is out of range [ 1542.545824][T20593] netlink: zone id is out of range [ 1542.575387][T20593] netlink: zone id is out of range [ 1542.581292][T20593] netlink: zone id is out of range [ 1542.597410][T20593] netlink: zone id is out of range [ 1542.716821][T20605] netlink: 'syz.3.15036': attribute type 1 has an invalid length. [ 1542.769097][T20605] bond7: entered promiscuous mode [ 1542.778287][T20605] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1542.811627][T20605] bond7: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1542.824006][T20605] bond7: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 1542.840296][T20605] bond7: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 1543.005118][T20623] netlink: 16 bytes leftover after parsing attributes in process `syz.1.15043'. [ 1543.238679][T20634] netlink: 44 bytes leftover after parsing attributes in process `syz.4.15045'. [ 1543.391276][T20648] bond2: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 1543.410778][T20648] bond2 (unregistering): Released all slaves [ 1543.459310][T20655] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15054'. [ 1543.523517][T20661] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15057'. [ 1543.609624][T20666] netlink: 24 bytes leftover after parsing attributes in process `syz.3.15058'. [ 1543.619368][T20661] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15057'. [ 1543.628336][T20661] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15057'. [ 1543.799433][T20670] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1543.806888][T20670] IPv6: NLM_F_CREATE should be set when creating new route [ 1543.814199][T20670] IPv6: NLM_F_CREATE should be set when creating new route [ 1544.463976][T20710] bond3: entered promiscuous mode [ 1544.473951][T20710] bond3: entered allmulticast mode [ 1544.815907][T20739] xt_cgroup: xt_cgroup: no path or classid specified [ 1545.005527][T20757] SET target dimension over the limit! [ 1545.163746][T20772] netlink: zone id is out of range [ 1545.172678][T20772] netlink: zone id is out of range [ 1545.182158][T20772] netlink: zone id is out of range [ 1545.200837][T20770] nbd: illegal input index 65508 [ 1545.430314][T20785] netlink: 'syz.3.15104': attribute type 11 has an invalid length. [ 1545.621289][T20800] geneve2: entered promiscuous mode [ 1546.329742][T20841] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1546.456729][T20841] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1546.660518][T20857] syzkaller1: entered promiscuous mode [ 1546.682257][T20857] syzkaller1: entered allmulticast mode [ 1546.834910][T20864] syzkaller0: entered promiscuous mode [ 1546.840451][T20864] syzkaller0: entered allmulticast mode [ 1546.965240][T20880] __nla_validate_parse: 15 callbacks suppressed [ 1546.965260][T20880] netlink: 4 bytes leftover after parsing attributes in process `syz.4.15137'. [ 1547.083185][T20885] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15138'. [ 1547.222278][T20891] syzkaller0: entered allmulticast mode [ 1547.239001][T20893] netlink: 20 bytes leftover after parsing attributes in process `syz.2.15141'. [ 1547.518512][T20904] validate_nla: 5 callbacks suppressed [ 1547.518555][T20904] netlink: 'syz.4.15145': attribute type 83 has an invalid length. [ 1547.605643][T20913] netlink: 'syz.2.15149': attribute type 16 has an invalid length. [ 1547.616430][T20913] netlink: 'syz.2.15149': attribute type 17 has an invalid length. [ 1547.700965][T20913] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1547.710742][T20913] 8021q: adding VLAN 0 to HW filter on device team0 [ 1547.729753][T20913] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1547.743112][T20927] netlink: 12 bytes leftover after parsing attributes in process `syz.1.15152'. [ 1547.839943][T20913] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1547.850933][T20913] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1547.886940][T20913] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1547.897324][T20913] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1547.913524][T20913] veth1_vlan: left promiscuous mode [ 1547.920312][T20913] veth0_vlan: left promiscuous mode [ 1547.928169][T20913] veth0_vlan: entered promiscuous mode [ 1547.937028][T20913] veth1_vlan: entered promiscuous mode [ 1547.947173][T20913] veth1_macvtap: left promiscuous mode [ 1547.954358][T20913] veth0_macvtap: left promiscuous mode [ 1547.960775][T20913] veth0_macvtap: entered promiscuous mode [ 1547.968067][T20913] veth1_macvtap: entered promiscuous mode [ 1547.986169][T20913] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1547.995005][T20913] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1548.004314][T20913] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1548.017308][T20913] 8021q: adding VLAN 0 to HW filter on device team1 [ 1548.027644][T20913] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1548.076524][ T4318] bridge0: port 1(bridge_slave_0) entered blocking state [ 1548.094860][ T4318] bridge0: port 1(bridge_slave_0) entered listening state [ 1548.104238][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1548.108281][ T4318] bridge0: port 2(bridge_slave_1) entered blocking state [ 1548.119302][ T4318] bridge0: port 2(bridge_slave_1) entered listening state [ 1548.154107][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1548.203094][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1548.237759][T31698] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1548.254675][T31698] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1548.292576][T31698] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1548.301386][T31698] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1548.366374][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1548.391711][T20948] ip6gre1: entered allmulticast mode [ 1548.416924][T31698] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1548.441584][ T4317] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1548.458257][T20954] netlink: 12 bytes leftover after parsing attributes in process `syz.1.15159'. [ 1548.470561][T31698] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1548.479339][T31698] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1548.485644][T20957] netlink: 100 bytes leftover after parsing attributes in process `syz.4.15161'. [ 1548.488033][T31698] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1548.509009][T31698] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1548.542357][T31698] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1548.566134][T20941] syzkaller0: entered promiscuous mode [ 1548.572961][T20941] syzkaller0: entered allmulticast mode [ 1548.602683][T31698] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1548.651872][T31698] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1548.698009][T20954] bond4: entered promiscuous mode [ 1548.703730][T20954] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1548.712486][ T4312] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1548.919933][T20975] netlink: 'syz.4.15167': attribute type 1 has an invalid length. [ 1549.032670][T20979] netlink: 16 bytes leftover after parsing attributes in process `syz.3.15168'. [ 1549.910862][T21001] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15173'. [ 1553.112668][ T4310] net_ratelimit: 140 callbacks suppressed [ 1553.112715][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1553.145133][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1553.181824][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1553.191725][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1553.218014][ T4316] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1553.226855][ T5641] Bluetooth: hci3: command 0x0406 tx timeout [ 1553.270739][ T4316] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1553.303454][ T4316] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1553.401746][ T4316] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1553.443413][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1553.545432][ T4317] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1553.593169][T20954] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1553.600304][T20954] bond4: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 1553.612940][T20954] bond4: (slave ip6gre2): Error -95 calling set_mac_address [ 1553.629926][T21001] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 1553.673851][T21005] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 1553.714328][T31698] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1553.732900][T31698] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1553.742666][ T4312] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1553.743560][T21011] netlink: 'syz.2.15175': attribute type 21 has an invalid length. [ 1553.758465][ T4312] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1553.782730][T30666] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1553.876936][T21017] syzkaller0: entered promiscuous mode [ 1553.882451][T21017] syzkaller0: entered allmulticast mode [ 1553.901743][T21021] netlink: 'syz.4.15179': attribute type 1 has an invalid length. [ 1554.173300][T21043] netlink: 4 bytes leftover after parsing attributes in process `syz.2.15184'. [ 1554.216832][T21033] netlink: 19 bytes leftover after parsing attributes in process `syz.2.15184'. [ 1554.486138][T21062] netlink: 'syz.1.15191': attribute type 1 has an invalid length. [ 1554.504993][T21054] bridge0: port 2(bridge_slave_1) entered disabled state [ 1554.512171][T21054] bridge0: port 1(bridge_slave_0) entered disabled state [ 1554.559755][T16301] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1554.639643][ T9271] IPVS: starting estimator thread 0... [ 1554.649545][T16301] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1554.657590][T21068] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 1554.666661][T21069] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 1554.674732][T21054] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1554.689836][T21054] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1554.825576][ T4310] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1554.834467][ T4310] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1554.843330][ T4310] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1554.864443][T21070] IPVS: using max 31 ests per chain, 74400 per kthread [ 1554.878973][ T4310] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1554.888470][ T4310] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1554.897891][ T4310] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1555.020940][T21075] netlink: 16 bytes leftover after parsing attributes in process `syz.1.15194'. [ 1555.214014][T21090] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15199'. [ 1555.275883][T21083] netlink: 19 bytes leftover after parsing attributes in process `syz.1.15199'. [ 1555.297390][T21099] netlink: 'syz.4.15204': attribute type 1 has an invalid length. [ 1555.701812][T21126] netlink: 'syz.4.15214': attribute type 21 has an invalid length. [ 1555.709778][T21126] IPv6: NLM_F_CREATE should be specified when creating new route [ 1555.867426][T21131] netlink: 12 bytes leftover after parsing attributes in process `syz.1.15216'. [ 1555.876172][T21133] netlink: 44 bytes leftover after parsing attributes in process `syz.4.15217'. [ 1556.527947][T21172] netlink: 'syz.0.15232': attribute type 1 has an invalid length. [ 1556.540791][T21173] netlink: 'syz.0.15232': attribute type 1 has an invalid length. [ 1556.596325][T21178] netlink: 'syz.2.15235': attribute type 2 has an invalid length. [ 1556.610100][T21179] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15233'. [ 1556.612276][T21172] bond1: entered promiscuous mode [ 1556.625809][T21172] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1556.637676][T21172] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15232'. [ 1556.646812][T21172] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15232'. [ 1556.690361][T21170] syzkaller0: entered promiscuous mode [ 1556.697217][T21170] syzkaller0: entered allmulticast mode [ 1557.145230][T21173] vlan3: entered allmulticast mode [ 1557.150415][T21173] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 1557.479414][T21217] netlink: 'syz.1.15247': attribute type 4 has an invalid length. [ 1557.565584][T21221] team0 (unregistering): Port device team_slave_0 removed [ 1557.580894][T21221] team0 (unregistering): Port device team_slave_1 removed [ 1557.908744][T21239] netlink: 'syz.0.15256': attribute type 1 has an invalid length. [ 1557.928584][T21239] bond2: entered promiscuous mode [ 1557.934338][T21239] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1557.952463][T21239] bond2: (slave ipvlan3): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1557.964870][T21239] bond2: (slave ipvlan3): The slave device specified does not support setting the MAC address [ 1557.975357][T21239] bond2: (slave ipvlan3): Setting fail_over_mac to active for active-backup mode [ 1558.052865][T21241] bond2: (slave ipvlan3): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1558.065296][T21241] bond2: (slave ipvlan3): The slave device specified does not support setting the MAC address [ 1558.201977][T21245] bond2: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1558.215907][T21245] bond2 (unregistering): Released all slaves [ 1558.556568][T16287] IPVS: starting estimator thread 0... [ 1558.781084][T21262] sctp: [Deprecated]: syz.1.15263 (pid 21262) Use of int in maxseg socket option. [ 1558.781084][T21262] Use struct sctp_assoc_value instead [ 1558.813082][T21266] bond8: Unable to set up delay as MII monitoring is disabled [ 1558.823207][T21266] bond8 (unregistering): Released all slaves [ 1558.899863][T21254] IPVS: using max 32 ests per chain, 76800 per kthread [ 1559.140266][T21286] validate_nla: 1 callbacks suppressed [ 1559.140284][T21286] netlink: 'syz.3.15273': attribute type 4 has an invalid length. [ 1559.342126][T21295] __nla_validate_parse: 8 callbacks suppressed [ 1559.342143][T21295] netlink: 4 bytes leftover after parsing attributes in process `syz.3.15278'. [ 1559.504053][T21309] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15283'. [ 1559.524121][T21309] bond5: option lacp_strict: mode dependency failed, not supported in mode balance-rr(0) [ 1559.542462][T21309] bond5 (unregistering): Released all slaves [ 1559.567532][T21311] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15283'. [ 1559.579402][T21311] sctp: [Deprecated]: syz.1.15283 (pid 21311) Use of int in max_burst socket option. [ 1559.579402][T21311] Use struct sctp_assoc_value instead [ 1559.771873][T21313] net_ratelimit: 20 callbacks suppressed [ 1559.771908][T21313] openvswitch: netlink: Missing key (keys=40, expected=100) [ 1560.003499][T21317] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15285'. [ 1560.393135][T21326] netlink: 4 bytes leftover after parsing attributes in process `syz.4.15288'. [ 1560.406514][T21326] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15288'. [ 1560.507393][T21330] netlink: 44 bytes leftover after parsing attributes in process `syz.3.15289'. [ 1560.598890][T21334] xt_hashlimit: size too large, truncated to 1048576 [ 1560.648223][T21336] nbd: must specify at least one socket [ 1561.200604][T21374] netlink: 32 bytes leftover after parsing attributes in process `syz.1.15305'. [ 1561.210469][T21373] netlink: 32 bytes leftover after parsing attributes in process `syz.1.15305'. [ 1561.220162][T21376] netlink: 8 bytes leftover after parsing attributes in process `syz.3.15306'. [ 1561.698937][T21410] netlink: 'syz.1.15317': attribute type 4 has an invalid length. [ 1561.866320][T21422] netlink: 'syz.3.15321': attribute type 1 has an invalid length. [ 1562.005573][T21419] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 1562.804465][T21466] tipc: Enabling not permitted [ 1562.831835][T21466] tipc: Enabling of bearer rejected, failed to enable media [ 1563.208035][T21493] netlink: 'syz.3.15344': attribute type 2 has an invalid length. [ 1563.387443][T21507] netlink: 'syz.3.15350': attribute type 2 has an invalid length. [ 1563.606416][T21509] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1563.680457][T21522] IPVS: set_ctl: invalid protocol: 98 172.20.20.59:20000 [ 1563.689231][T21522] IPVS: length: 20 != 8 [ 1563.866791][T21532] netlink: 'syz.3.15359': attribute type 9 has an invalid length. [ 1563.959862][T21534] netlink: 'syz.4.15358': attribute type 4 has an invalid length. [ 1564.117378][T21550] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 1564.331116][T21567] netlink: 'syz.4.15371': attribute type 1 has an invalid length. [ 1564.567081][T21578] __nla_validate_parse: 15 callbacks suppressed [ 1564.567100][T21578] netlink: 128 bytes leftover after parsing attributes in process `syz.3.15373'. [ 1564.617189][T21580] netlink: 'syz.0.15374': attribute type 4 has an invalid length. [ 1564.685934][T21587] netlink: 44 bytes leftover after parsing attributes in process `syz.3.15377'. [ 1564.753151][T21592] FAULT_INJECTION: forcing a failure. [ 1564.753151][T21592] name failslab, interval 1, probability 0, space 0, times 0 [ 1564.765810][T21592] CPU: 1 UID: 0 PID: 21592 Comm: syz.0.15378 Not tainted syzkaller #0 PREEMPT(full) [ 1564.765836][T21592] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1564.765847][T21592] Call Trace: [ 1564.765855][T21592] [ 1564.765863][T21592] dump_stack_lvl+0xe8/0x150 [ 1564.765894][T21592] should_fail_ex+0x40c/0x560 [ 1564.765919][T21592] should_failslab+0xa8/0x100 [ 1564.765944][T21592] __kmalloc_noprof+0xfe/0x720 [ 1564.765967][T21592] ? tomoyo_encode+0x2ad/0x570 [ 1564.765986][T21592] ? tomoyo_encode+0x2ad/0x570 [ 1564.766010][T21592] tomoyo_encode+0x2ad/0x570 [ 1564.766032][T21592] tomoyo_realpath_from_path+0x5fa/0x640 [ 1564.766061][T21592] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1564.766088][T21592] tomoyo_path_number_perm+0x246/0x5f0 [ 1564.766117][T21592] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1564.766143][T21592] ? __lock_acquire+0x683/0x2cf0 [ 1564.766183][T21592] ? hook_file_ioctl+0x1f0/0x5f0 [ 1564.766225][T21592] ? __fget_files+0x2a/0x420 [ 1564.766250][T21592] ? __fget_files+0x2a/0x420 [ 1564.766270][T21592] ? __fget_files+0x3a2/0x420 [ 1564.766290][T21592] ? __fget_files+0x2a/0x420 [ 1564.766312][T21592] security_file_ioctl+0xc3/0x2a0 [ 1564.766339][T21592] __se_sys_ioctl+0x47/0x170 [ 1564.766357][T21592] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1564.766375][T21592] do_syscall_64+0x174/0x580 [ 1564.766397][T21592] ? trace_irq_disable+0x3b/0x140 [ 1564.766418][T21592] ? clear_bhb_loop+0x40/0x90 [ 1564.766440][T21592] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1564.766468][T21592] RIP: 0033:0x7f25cf19de59 [ 1564.766486][T21592] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1564.766500][T21592] RSP: 002b:00007f25d00db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1564.766518][T21592] RAX: ffffffffffffffda RBX: 00007f25cf425fa0 RCX: 00007f25cf19de59 [ 1564.766531][T21592] RDX: 0000200000000000 RSI: 0000000000008946 RDI: 0000000000000005 [ 1564.766542][T21592] RBP: 00007f25d00db090 R08: 0000000000000000 R09: 0000000000000000 [ 1564.766554][T21592] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1564.766565][T21592] R13: 00007f25cf426038 R14: 00007f25cf425fa0 R15: 00007fff9e6f4a98 [ 1564.766595][T21592] [ 1564.766616][T21592] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1564.859585][T21597] sock: sock_set_timeout: `syz.3.15381' (pid 21597) tries to set negative timeout [ 1564.995536][T21601] bridge0: entered promiscuous mode [ 1565.064175][T21601] bridge0: entered allmulticast mode [ 1565.258191][T21612] netlink: 'syz.4.15386': attribute type 4 has an invalid length. [ 1565.309871][T21614] netlink: 'syz.4.15388': attribute type 2 has an invalid length. [ 1565.332077][T21616] netlink: 4 bytes leftover after parsing attributes in process `syz.2.15387'. [ 1565.505730][T21620] netlink: 808 bytes leftover after parsing attributes in process `syz.2.15387'. [ 1565.647897][T21625] netlink: 'syz.0.15391': attribute type 8 has an invalid length. [ 1565.666083][T21625] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15391'. [ 1565.676659][T21625] bridge0: port 2(bridge_slave_1) entered disabled state [ 1565.684352][T21625] bridge0: port 1(bridge_slave_0) entered disabled state [ 1565.729073][T21626] IPVS: length: 167 != 8 [ 1565.910188][T21644] netlink: 'syz.2.15398': attribute type 4 has an invalid length. [ 1565.950611][T21642] netlink: 'syz.4.15399': attribute type 2 has an invalid length. [ 1565.998707][T21649] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15401'. [ 1566.554789][T21669] netlink: 72 bytes leftover after parsing attributes in process `syz.1.15408'. [ 1566.784113][T21678] netlink: 'syz.3.15411': attribute type 4 has an invalid length. [ 1566.901633][T21682] netlink: 'syz.4.15412': attribute type 2 has an invalid length. [ 1567.085359][T21685] bond8: option arp_all_targets: invalid value (18446744073709551613) [ 1567.095521][T21685] bond8 (unregistering): Released all slaves [ 1567.344026][T21713] netlink: 'syz.1.15425': attribute type 61 has an invalid length. [ 1567.939866][T21754] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1567.961874][T21754] bond0: (slave netdevsim1): Enslaving as an active interface with a down link [ 1568.508999][T21780] netlink: 16 bytes leftover after parsing attributes in process `syz.4.15450'. [ 1568.522393][T21780] netlink: 8 bytes leftover after parsing attributes in process `syz.4.15450'. [ 1568.554503][T21788] netlink: 40 bytes leftover after parsing attributes in process `syz.3.15449'. [ 1569.610319][T21844] __nla_validate_parse: 5 callbacks suppressed [ 1569.610338][T21844] netlink: 4 bytes leftover after parsing attributes in process `syz.4.15472'. [ 1569.720927][T21844] validate_nla: 3 callbacks suppressed [ 1569.720950][T21844] netlink: 'syz.4.15472': attribute type 1 has an invalid length. [ 1569.772418][T21844] netlink: 'syz.4.15472': attribute type 2 has an invalid length. [ 1569.802962][T21840] netlink: 48 bytes leftover after parsing attributes in process `syz.1.15469'. [ 1570.349002][T21878] netlink: 28 bytes leftover after parsing attributes in process `syz.3.15482'. [ 1570.394449][T21878] netlink: 28 bytes leftover after parsing attributes in process `syz.3.15482'. [ 1570.607240][T21887] netlink: 'syz.0.15487': attribute type 30 has an invalid length. [ 1570.915134][ T4318] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 1570.986804][T21904] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1571.013900][T21914] netlink: 16 bytes leftover after parsing attributes in process `syz.3.15494'. [ 1571.043190][T21913] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15493'. [ 1571.085881][T21904] netlink: 76 bytes leftover after parsing attributes in process `syz.0.15492'. [ 1571.450875][T21925] netlink: 'syz.4.15498': attribute type 4 has an invalid length. [ 1571.742778][T21945] netlink: 'syz.2.15506': attribute type 2 has an invalid length. [ 1571.960485][T21962] bridge_slave_1: left allmulticast mode [ 1571.966278][T21962] bridge_slave_1: left promiscuous mode [ 1571.972083][T21962] bridge0: port 2(bridge_slave_1) entered disabled state [ 1571.993561][T21962] bridge_slave_0: left allmulticast mode [ 1571.999519][T21962] bridge_slave_0: left promiscuous mode [ 1572.056870][T21962] bridge0: port 1(bridge_slave_0) entered disabled state [ 1572.170964][T21979] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15517'. [ 1572.180138][T21979] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15517'. [ 1572.190452][T21979] netlink: 'syz.1.15517': attribute type 15 has an invalid length. [ 1572.204035][ T4310] netdevsim netdevsim1 netdevsim0: set [0, 1] type 1 family 0 port 256 - 0 [ 1572.211161][T21979] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15517'. [ 1572.212844][ T4310] netdevsim netdevsim1 netdevsim1: set [0, 1] type 1 family 0 port 256 - 0 [ 1572.221816][T21979] netlink: 'syz.1.15517': attribute type 15 has an invalid length. [ 1572.254452][ T4310] netdevsim netdevsim1 netdevsim2: set [0, 1] type 1 family 0 port 256 - 0 [ 1572.263971][ T4310] netdevsim netdevsim1 netdevsim3: set [0, 1] type 1 family 0 port 256 - 0 [ 1572.285080][T21981] bond3: entered promiscuous mode [ 1572.290444][T21981] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1572.473394][T21991] netlink: 'syz.1.15521': attribute type 2 has an invalid length. [ 1572.809172][T22015] veth0: entered promiscuous mode [ 1572.815111][T22015] veth0: left promiscuous mode [ 1572.867917][T22017] syzkaller1: tun_chr_ioctl cmd 1074025678 [ 1572.873780][T22017] syzkaller1: group set to 0 [ 1572.890596][T22023] netlink: 'syz.3.15535': attribute type 2 has an invalid length. [ 1572.900778][T22024] netlink: 'syz.0.15536': attribute type 4 has an invalid length. [ 1572.934558][T22021] syzkaller0: entered promiscuous mode [ 1572.940648][T22021] syzkaller0: entered allmulticast mode [ 1573.045965][T22021] rB speed is unknown, defaulting to 1000 [ 1573.150609][T22033] gtp0: entered promiscuous mode [ 1573.155620][T22033] gtp0: entered allmulticast mode [ 1573.308599][T22041] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1573.325242][T22021] virt_wifi0 speed is unknown, defaulting to 1000 [ 1573.520200][T22050] syzkaller0: entered promiscuous mode [ 1573.526124][T22050] syzkaller0: entered allmulticast mode [ 1573.702249][T20788] Bluetooth: hci2: command 0x0406 tx timeout [ 1573.887399][T22060] FAULT_INJECTION: forcing a failure. [ 1573.887399][T22060] name failslab, interval 1, probability 0, space 0, times 0 [ 1573.928973][T22060] CPU: 0 UID: 0 PID: 22060 Comm: syz.3.15550 Not tainted syzkaller #0 PREEMPT(full) [ 1573.929000][T22060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1573.929012][T22060] Call Trace: [ 1573.929020][T22060] [ 1573.929029][T22060] dump_stack_lvl+0xe8/0x150 [ 1573.929063][T22060] should_fail_ex+0x40c/0x560 [ 1573.929091][T22060] should_failslab+0xa8/0x100 [ 1573.929121][T22060] __kmalloc_noprof+0xfe/0x720 [ 1573.929147][T22060] ? nla_strdup+0x9d/0x140 [ 1573.929169][T22060] ? nla_strdup+0x9d/0x140 [ 1573.929199][T22060] nla_strdup+0x9d/0x140 [ 1573.929225][T22060] nf_tables_updchain+0xba8/0x2190 [ 1573.929275][T22060] ? nft_pernet+0x23/0x240 [ 1573.929301][T22060] ? nft_pernet+0x23/0x240 [ 1573.929325][T22060] ? __pfx_nf_tables_updchain+0x10/0x10 [ 1573.929363][T22060] nf_tables_newchain+0xdd3/0x28b0 [ 1573.929401][T22060] ? __pfx_nf_tables_newchain+0x10/0x10 [ 1573.929438][T22060] ? __pfx___nla_validate_parse+0x10/0x10 [ 1573.929479][T22060] ? nfnl_pernet+0x23/0x240 [ 1573.929505][T22060] ? nfnl_pernet+0x23/0x240 [ 1573.929540][T22060] ? __nla_parse+0x40/0x60 [ 1573.929569][T22060] nfnetlink_rcv+0x1288/0x28c0 [ 1573.929631][T22060] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1573.929706][T22060] ? netlink_deliver_tap+0x2e/0x1b0 [ 1573.929746][T22060] ? netlink_deliver_tap+0x2e/0x1b0 [ 1573.929773][T22060] ? netlink_deliver_tap+0x2e/0x1b0 [ 1573.929807][T22060] netlink_unicast+0x7bb/0x940 [ 1573.929845][T22060] netlink_sendmsg+0x813/0xb40 [ 1573.929882][T22060] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1573.929921][T22060] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1573.929947][T22060] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1573.929974][T22060] sock_sendmsg_nosec+0x13a/0x180 [ 1573.929998][T22060] ____sys_sendmsg+0x54e/0x850 [ 1573.930033][T22060] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1573.930073][T22060] ? import_iovec+0x73/0xa0 [ 1573.930104][T22060] ___sys_sendmsg+0x2a5/0x360 [ 1573.930131][T22060] ? __lock_acquire+0x683/0x2cf0 [ 1573.930161][T22060] ? __pfx____sys_sendmsg+0x10/0x10 [ 1573.930227][T22060] ? __fget_files+0x2a/0x420 [ 1573.930251][T22060] ? __fget_files+0x3a2/0x420 [ 1573.930286][T22060] __x64_sys_sendmsg+0x1b1/0x290 [ 1573.930318][T22060] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1573.930365][T22060] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1573.930388][T22060] do_syscall_64+0x174/0x580 [ 1573.930411][T22060] ? trace_irq_disable+0x3b/0x140 [ 1573.930435][T22060] ? clear_bhb_loop+0x40/0x90 [ 1573.930459][T22060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1573.930479][T22060] RIP: 0033:0x7fb1c1d9de59 [ 1573.930499][T22060] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1573.930517][T22060] RSP: 002b:00007fb1c2c5f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1573.930538][T22060] RAX: ffffffffffffffda RBX: 00007fb1c2025fa0 RCX: 00007fb1c1d9de59 [ 1573.930553][T22060] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1573.930565][T22060] RBP: 00007fb1c2c5f090 R08: 0000000000000000 R09: 0000000000000000 [ 1573.930577][T22060] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1573.930588][T22060] R13: 00007fb1c2026038 R14: 00007fb1c2025fa0 R15: 00007ffc365b0348 [ 1573.930618][T22060] [ 1574.755308][T22086] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1574.909645][T22093] __nla_validate_parse: 7 callbacks suppressed [ 1574.909664][T22093] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15560'. [ 1574.924814][T22093] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15560'. [ 1574.992108][T22093] validate_nla: 2 callbacks suppressed [ 1574.992125][T22093] netlink: 'syz.2.15560': attribute type 2 has an invalid length. [ 1575.036937][T22099] netlink: 'syz.3.15563': attribute type 4 has an invalid length. [ 1575.039260][T22093] netlink: 'syz.2.15560': attribute type 1 has an invalid length. [ 1575.200104][T22116] Bluetooth: MGMT ver 1.23 [ 1575.282780][T22103] netlink: 19 bytes leftover after parsing attributes in process `syz.0.15566'. [ 1575.503994][T22131] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15571'. [ 1575.520374][T22139] netlink: 'syz.2.15575': attribute type 4 has an invalid length. [ 1575.764533][T22148] netlink: 4 bytes leftover after parsing attributes in process `syz.2.15577'. [ 1575.928202][T22163] netlink: 20 bytes leftover after parsing attributes in process `syz.4.15582'. [ 1575.929405][T22165] netlink: 'syz.1.15584': attribute type 4 has an invalid length. [ 1576.031081][T22178] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15583'. [ 1576.142078][ T9272] IPVS: starting estimator thread 0... [ 1576.160705][T22185] netlink: 'syz.3.15587': attribute type 4 has an invalid length. [ 1576.173134][T22156] netlink: 19 bytes leftover after parsing attributes in process `syz.2.15581'. [ 1576.186322][T22186] netlink: 52 bytes leftover after parsing attributes in process `syz.4.15588'. [ 1576.195484][T22186] netlink: 44 bytes leftover after parsing attributes in process `syz.4.15588'. [ 1576.326201][T22193] netlink: 'syz.3.15590': attribute type 6 has an invalid length. [ 1576.449653][T22182] IPVS: using max 28 ests per chain, 67200 per kthread [ 1576.627376][T22217] netlink: 'syz.3.15600': attribute type 4 has an invalid length. [ 1576.744111][T22218] macvtap1: entered promiscuous mode [ 1576.749784][T22218] vlan0: entered promiscuous mode [ 1576.755759][T22218] macvtap1: entered allmulticast mode [ 1576.761530][T22218] vlan0: entered allmulticast mode [ 1576.766796][T22218] veth0_vlan: entered allmulticast mode [ 1577.094782][T22247] gre0: entered promiscuous mode [ 1577.113155][T22247] gre0: entered allmulticast mode [ 1577.154084][T22251] netlink: 'syz.4.15611': attribute type 4 has an invalid length. [ 1577.273045][T22255] xt_hashlimit: size too large, truncated to 1048576 [ 1577.283315][T22257] GUP no longer grows the stack in syz.4.15614 (22257): 200000003000-20000000a000 (200000001000) [ 1577.294870][T22257] CPU: 1 UID: 0 PID: 22257 Comm: syz.4.15614 Not tainted syzkaller #0 PREEMPT(full) [ 1577.294896][T22257] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1577.294908][T22257] Call Trace: [ 1577.294917][T22257] [ 1577.294925][T22257] dump_stack_lvl+0xe8/0x150 [ 1577.294960][T22257] __get_user_pages+0x238c/0x2720 [ 1577.294996][T22257] ? __gup_longterm_locked+0xc3b/0x15c0 [ 1577.295045][T22257] __gup_longterm_locked+0xd52/0x15c0 [ 1577.295068][T22257] ? lock_acquire+0x106/0x350 [ 1577.295112][T22257] gup_fast_fallback+0x1d8c/0x20e0 [ 1577.295167][T22257] ? __pfx_gup_fast_fallback+0x10/0x10 [ 1577.295188][T22257] ? is_valid_gup_args+0x11f/0x200 [ 1577.295210][T22257] ? get_user_pages_fast+0x4d/0xb0 [ 1577.295232][T22257] __iov_iter_get_pages_alloc+0x378/0xa40 [ 1577.295267][T22257] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 1577.295300][T22257] iov_iter_get_pages2+0x5e/0xa0 [ 1577.295330][T22257] __se_sys_vmsplice+0x7b5/0x1660 [ 1577.295378][T22257] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 1577.295405][T22257] ? __pfx_futex_wait+0x10/0x10 [ 1577.295490][T22257] ? vm_mmap_pgoff+0x35a/0x4e0 [ 1577.295562][T22257] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1577.295583][T22257] do_syscall_64+0x174/0x580 [ 1577.295608][T22257] ? trace_irq_disable+0x3b/0x140 [ 1577.295631][T22257] ? clear_bhb_loop+0x40/0x90 [ 1577.295656][T22257] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1577.295675][T22257] RIP: 0033:0x7f7f0339de59 [ 1577.295694][T22257] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1577.295711][T22257] RSP: 002b:00007f7f0433e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 1577.295731][T22257] RAX: ffffffffffffffda RBX: 00007f7f03625fa0 RCX: 00007f7f0339de59 [ 1577.295745][T22257] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 000000000000000b [ 1577.295758][T22257] RBP: 00007f7f03433e6f R08: 0000000000000000 R09: 0000000000000000 [ 1577.295770][T22257] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 1577.295780][T22257] R13: 00007f7f03626038 R14: 00007f7f03625fa0 R15: 00007ffd29e3da08 [ 1577.295811][T22257] [ 1577.993946][T22295] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'syz0' [ 1582.478715][T22336] __nla_validate_parse: 12 callbacks suppressed [ 1582.478734][T22336] netlink: 52 bytes leftover after parsing attributes in process `syz.2.15637'. [ 1582.535879][T22336] netlink: 44 bytes leftover after parsing attributes in process `syz.2.15637'. [ 1582.560516][T22345] netlink: 20 bytes leftover after parsing attributes in process `syz.4.15640'. [ 1582.598248][T22335] netlink: 19 bytes leftover after parsing attributes in process `syz.1.15636'. [ 1582.913367][T22365] netlink: 84 bytes leftover after parsing attributes in process `syz.1.15646'. [ 1583.182089][T22378] netlink: 128 bytes leftover after parsing attributes in process `syz.4.15651'. [ 1583.191555][T22378] netlink: 128 bytes leftover after parsing attributes in process `syz.4.15651'. [ 1583.437746][T22392] netlink: 4 bytes leftover after parsing attributes in process `syz.0.15657'. [ 1583.574319][T22398] netlink: 176 bytes leftover after parsing attributes in process `syz.3.15658'. [ 1583.583991][T22398] netlink: 32 bytes leftover after parsing attributes in process `syz.3.15658'. [ 1583.778931][T22413] netlink: 'syz.1.15663': attribute type 2 has an invalid length. [ 1584.869347][T22472] netlink: 'syz.2.15686': attribute type 4 has an invalid length. [ 1585.297567][T22493] netlink: 'syz.2.15694': attribute type 2 has an invalid length. [ 1585.311812][T22496] block nbd4: NBD_DISCONNECT [ 1585.316488][T22496] block nbd4: Send disconnect failed -32 [ 1585.331774][T22496] block nbd4: shutting down sockets [ 1585.510767][T22509] netlink: 'syz.3.15698': attribute type 4 has an invalid length. [ 1586.266808][T22547] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only [ 1586.981539][T22572] syzkaller0: entered promiscuous mode [ 1586.987059][T22572] syzkaller0: entered allmulticast mode [ 1587.269947][T22606] xt_hl: Unknown TTL match mode: 255 [ 1591.590668][T22627] netlink: 'syz.2.15737': attribute type 4 has an invalid length. [ 1591.695878][T22632] sctp: [Deprecated]: syz.4.15739 (pid 22632) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1591.695878][T22632] Use struct sctp_sack_info instead [ 1591.799146][T22635] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 1591.816840][T22635] gretap2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 1591.833759][T22635] gretap2: entered promiscuous mode [ 1591.842796][T22635] gretap2: entered allmulticast mode [ 1591.858064][T22637] gre1: entered promiscuous mode [ 1592.120172][ T62] bridge_slave_1: left allmulticast mode [ 1592.131352][ T62] bridge_slave_1: left promiscuous mode [ 1592.142188][ T62] bridge0: port 2(bridge_slave_1) entered disabled state [ 1592.155104][ T62] bridge_slave_0: left allmulticast mode [ 1592.160913][ T62] bridge_slave_0: left promiscuous mode [ 1592.167339][ T62] bridge0: port 1(bridge_slave_0) entered disabled state [ 1592.256670][T22652] __nla_validate_parse: 8 callbacks suppressed [ 1592.256699][T22652] netlink: 8 bytes leftover after parsing attributes in process `syz.3.15747'. [ 1592.438269][ T62] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 1592.468515][ T62] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 1592.489676][ T62] .` (unregistering): Released all slaves [ 1592.503039][ T62] bond1 (unregistering): Released all slaves [ 1592.538653][ T62] bond0 (unregistering): Released all slaves [ 1592.560549][ T62] bond2 (unregistering): Released all slaves [ 1592.590577][ T62] bond3 (unregistering): Released all slaves [ 1592.609880][ T62] bond4 (unregistering): Released all slaves [ 1592.628772][ T62] bond5 (unregistering): Released all slaves [ 1592.647382][ T62] bond6 (unregistering): Released all slaves [ 1592.687718][ T62] bond7 (unregistering): Released all slaves [ 1592.711187][T22665] netlink: 48 bytes leftover after parsing attributes in process `syz.4.15750'. [ 1592.734232][T22652] veth0: entered promiscuous mode [ 1592.740058][T22665] netlink: 48 bytes leftover after parsing attributes in process `syz.4.15750'. [ 1592.751001][T22651] veth0: left promiscuous mode [ 1592.763424][T22664] netlink: 'syz.4.15750': attribute type 23 has an invalid length. [ 1592.774350][T22668] netlink: 20 bytes leftover after parsing attributes in process `syz.1.15752'. [ 1592.818020][T22664] bridge0: port 3(geneve0) entered blocking state [ 1592.824648][T22664] bridge0: port 3(geneve0) entered disabled state [ 1592.831337][T22664] geneve0: entered allmulticast mode [ 1592.838562][T22664] geneve0: entered promiscuous mode [ 1592.844637][T22664] bridge0: port 3(geneve0) entered blocking state [ 1592.851172][T22664] bridge0: port 3(geneve0) entered listening state [ 1593.097295][T22687] openvswitch: netlink: IP tunnel dst address not specified [ 1593.135180][T22687] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1593.230142][T22680] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1593.293370][T22680] 8021q: adding VLAN 0 to HW filter on device team0 [ 1593.390787][T22680] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1593.455974][T22703] netlink: 20 bytes leftover after parsing attributes in process `syz.0.15764'. [ 1593.678801][T22680] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1593.729540][T22680] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1593.759737][T22680] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1593.770211][T22680] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1593.856672][T22680] veth1_vlan: left promiscuous mode [ 1593.879798][T22680] veth0_vlan: left promiscuous mode [ 1593.888408][T22680] veth0_vlan: entered promiscuous mode [ 1593.898340][T22680] veth1_vlan: entered promiscuous mode [ 1593.920789][T22680] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1593.930412][T22680] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1593.939849][T22680] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1593.959468][T22680] 8021q: adding VLAN 0 to HW filter on device team1 [ 1593.969939][T22680] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1594.065152][T14282] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1594.074263][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1594.097534][ T4312] bridge0: port 1(bridge_slave_0) entered blocking state [ 1594.104764][ T4312] bridge0: port 1(bridge_slave_0) entered listening state [ 1594.120419][ T4312] bridge0: port 2(bridge_slave_1) entered blocking state [ 1594.127680][ T4312] bridge0: port 2(bridge_slave_1) entered listening state [ 1594.138363][T31698] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1594.163038][T31698] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1594.182228][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1594.202332][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1594.232890][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1594.275733][ T4310] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1594.284645][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1594.302257][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1594.310298][ T4310] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1594.334337][ T4310] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1594.345192][ T4310] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1594.426998][ T4310] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1594.436114][ T4310] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1594.557215][ T4313] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1594.609149][ T4313] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1594.679360][T22730] FAULT_INJECTION: forcing a failure. [ 1594.679360][T22730] name failslab, interval 1, probability 0, space 0, times 0 [ 1594.724148][T22730] CPU: 0 UID: 0 PID: 22730 Comm: syz.1.15772 Not tainted syzkaller #0 PREEMPT(full) [ 1594.724182][T22730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1594.724199][T22730] Call Trace: [ 1594.724210][T22730] [ 1594.724221][T22730] dump_stack_lvl+0xe8/0x150 [ 1594.724252][T22730] should_fail_ex+0x40c/0x560 [ 1594.724276][T22730] should_failslab+0xa8/0x100 [ 1594.724299][T22730] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 1594.724317][T22730] ? local_lock_release+0x9c/0x160 [ 1594.724339][T22730] ? __alloc_skb+0x1d7/0x7a0 [ 1594.724355][T22730] ? __alloc_skb+0x1d7/0x7a0 [ 1594.724377][T22730] __alloc_skb+0x1d7/0x7a0 [ 1594.724401][T22730] netlink_sendmsg+0x5d4/0xb40 [ 1594.724434][T22730] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1594.724458][T22730] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1594.724478][T22730] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1594.724499][T22730] sock_sendmsg_nosec+0x13a/0x180 [ 1594.724518][T22730] ____sys_sendmsg+0x54e/0x850 [ 1594.724547][T22730] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1594.724573][T22730] ? import_iovec+0x73/0xa0 [ 1594.724596][T22730] ___sys_sendmsg+0x2a5/0x360 [ 1594.724615][T22730] ? __lock_acquire+0x683/0x2cf0 [ 1594.724640][T22730] ? __pfx____sys_sendmsg+0x10/0x10 [ 1594.724690][T22730] ? __fget_files+0x2a/0x420 [ 1594.724709][T22730] ? __fget_files+0x3a2/0x420 [ 1594.724734][T22730] __x64_sys_sendmsg+0x1b1/0x290 [ 1594.724757][T22730] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1594.724792][T22730] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1594.724810][T22730] do_syscall_64+0x174/0x580 [ 1594.724832][T22730] ? trace_irq_disable+0x3b/0x140 [ 1594.724852][T22730] ? clear_bhb_loop+0x40/0x90 [ 1594.724873][T22730] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1594.724887][T22730] RIP: 0033:0x7f070059de59 [ 1594.724904][T22730] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1594.724918][T22730] RSP: 002b:00007f0701437028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1594.724934][T22730] RAX: ffffffffffffffda RBX: 00007f0700825fa0 RCX: 00007f070059de59 [ 1594.724945][T22730] RDX: 0000000000044000 RSI: 0000200000000200 RDI: 0000000000000003 [ 1594.724954][T22730] RBP: 00007f0701437090 R08: 0000000000000000 R09: 0000000000000000 [ 1594.724963][T22730] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1594.724971][T22730] R13: 00007f0700826038 R14: 00007f0700825fa0 R15: 00007ffe70f991b8 [ 1594.724996][T22730] [ 1594.822053][ T6525] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1594.871401][T22736] IPv6: NLM_F_CREATE should be specified when creating new route [ 1594.993229][T16317] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1595.210688][ T5641] block nbd4: Receive control failed (result -32) [ 1595.390721][T22751] netlink: 4 bytes leftover after parsing attributes in process `syz.3.15777'. [ 1595.417986][T22756] xt_TCPMSS: Only works on TCP SYN packets [ 1595.701646][ T62] hsr_slave_0: left promiscuous mode [ 1595.921412][ T62] hsr_slave_1: left promiscuous mode [ 1596.589304][ T62] team0 (unregistering): Port device team_slave_1 removed [ 1596.612207][ T62] team0 (unregistering): Port device team_slave_0 removed [ 1597.598866][T22821] RDS: rds_bind could not find a transport for ::ffff:10.1.1.1, load rds_tcp or rds_rdma? [ 1598.148271][ T62] IPVS: stop unused estimator thread 0... [ 1598.184116][ T4318] net_ratelimit: 63 callbacks suppressed [ 1598.184137][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1598.200447][ T4318] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1598.311789][ T4312] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1598.320862][ T4312] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1598.431713][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1598.439671][ T1164] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1598.551713][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1598.559614][ T1164] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1598.671751][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1598.679572][ T1164] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1598.982019][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1599.246269][T22791] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1599.398207][T22833] netlink: 20 bytes leftover after parsing attributes in process `syz.0.15799'. [ 1599.431243][T22833] netlink: 4 bytes leftover after parsing attributes in process `syz.0.15799'. [ 1599.476257][T22834] netlink: 20 bytes leftover after parsing attributes in process `syz.0.15799'. [ 1599.495171][T22834] netlink: 4 bytes leftover after parsing attributes in process `syz.0.15799'. [ 1599.613778][T22846] netlink: 16 bytes leftover after parsing attributes in process `syz.0.15804'. [ 1600.233496][T22867] netlink: 'syz.1.15810': attribute type 83 has an invalid length. [ 1600.376532][T22871] xt_hashlimit: Unknown mode mask 2000, kernel too old? [ 1600.419813][T22871] 8021q: VLANs not supported on ip6_vti0 [ 1600.455932][T22875] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15814'. [ 1600.862766][T22891] vlan3: entered allmulticast mode [ 1600.910438][T22894] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15824'. [ 1601.190899][T22894] bond0: (slave bond_slave_0): Releasing backup interface [ 1601.246261][T22894] bond0: (slave bond_slave_1): Releasing backup interface [ 1601.275687][T22911] netlink: 16215 bytes leftover after parsing attributes in process `syz.1.15826'. [ 1601.279309][T22894] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1601.294859][T22894] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1601.329351][T22914] netlink: 'syz.3.15827': attribute type 1 has an invalid length. [ 1601.358689][T22913] netlink: 'syz.3.15827': attribute type 1 has an invalid length. [ 1601.492055][T22914] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1601.512103][T22916] bond8: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1601.575387][T22929] netlink: 25 bytes leftover after parsing attributes in process `syz.1.15829'. [ 1601.640226][T22929] netlink: 'syz.1.15829': attribute type 3 has an invalid length. [ 1601.676028][T22929] netlink: 'syz.1.15829': attribute type 1 has an invalid length. [ 1601.724866][T22929] netlink: 204 bytes leftover after parsing attributes in process `syz.1.15829'. [ 1601.832190][T22940] syzkaller0: entered promiscuous mode [ 1601.837778][T22940] syzkaller0: entered allmulticast mode [ 1601.924778][T22946] geneve3: entered promiscuous mode [ 1601.930123][T22946] geneve3: entered allmulticast mode [ 1601.947549][ T62] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 1601.959101][ T62] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 1601.970542][ T62] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 1601.983102][ T62] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 19999 - 0 [ 1602.036312][T22948] FAULT_INJECTION: forcing a failure. [ 1602.036312][T22948] name failslab, interval 1, probability 0, space 0, times 0 [ 1602.086049][T22948] CPU: 0 UID: 0 PID: 22948 Comm: syz.0.15835 Not tainted syzkaller #0 PREEMPT(full) [ 1602.086075][T22948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1602.086086][T22948] Call Trace: [ 1602.086094][T22948] [ 1602.086102][T22948] dump_stack_lvl+0xe8/0x150 [ 1602.086136][T22948] should_fail_ex+0x40c/0x560 [ 1602.086162][T22948] should_failslab+0xa8/0x100 [ 1602.086189][T22948] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 1602.086213][T22948] ? skb_clone+0x212/0x3a0 [ 1602.086240][T22948] ? skb_clone+0x212/0x3a0 [ 1602.086273][T22948] skb_clone+0x212/0x3a0 [ 1602.086303][T22948] __netlink_deliver_tap+0x413/0x860 [ 1602.086345][T22948] ? netlink_deliver_tap+0x2e/0x1b0 [ 1602.086375][T22948] netlink_deliver_tap+0x19c/0x1b0 [ 1602.086405][T22948] netlink_sendskb+0x68/0x140 [ 1602.086434][T22948] netlink_rcv_skb+0x2a4/0x4a0 [ 1602.086462][T22948] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1602.086487][T22948] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1602.086531][T22948] ? down_read+0x2be/0x330 [ 1602.086564][T22948] genl_rcv+0x28/0x40 [ 1602.086593][T22948] netlink_unicast+0x7bb/0x940 [ 1602.086631][T22948] netlink_sendmsg+0x813/0xb40 [ 1602.086671][T22948] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1602.086704][T22948] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1602.086730][T22948] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1602.086757][T22948] sock_sendmsg_nosec+0x13a/0x180 [ 1602.086783][T22948] ____sys_sendmsg+0x54e/0x850 [ 1602.086813][T22948] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1602.086847][T22948] ? import_iovec+0x73/0xa0 [ 1602.086873][T22948] ___sys_sendmsg+0x2a5/0x360 [ 1602.086898][T22948] ? __lock_acquire+0x683/0x2cf0 [ 1602.086926][T22948] ? __pfx____sys_sendmsg+0x10/0x10 [ 1602.086986][T22948] ? __fget_files+0x2a/0x420 [ 1602.087009][T22948] ? __fget_files+0x3a2/0x420 [ 1602.087042][T22948] __x64_sys_sendmsg+0x1b1/0x290 [ 1602.087072][T22948] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1602.087118][T22948] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1602.087139][T22948] do_syscall_64+0x174/0x580 [ 1602.087167][T22948] ? trace_irq_disable+0x3b/0x140 [ 1602.087187][T22948] ? clear_bhb_loop+0x40/0x90 [ 1602.087210][T22948] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1602.087228][T22948] RIP: 0033:0x7f25cf19de59 [ 1602.087245][T22948] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1602.087259][T22948] RSP: 002b:00007f25d00db028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1602.087279][T22948] RAX: ffffffffffffffda RBX: 00007f25cf425fa0 RCX: 00007f25cf19de59 [ 1602.087292][T22948] RDX: 0000000000044000 RSI: 0000200000000200 RDI: 0000000000000003 [ 1602.087304][T22948] RBP: 00007f25d00db090 R08: 0000000000000000 R09: 0000000000000000 [ 1602.087315][T22948] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1602.087327][T22948] R13: 00007f25cf426038 R14: 00007f25cf425fa0 R15: 00007fff9e6f4a98 [ 1602.087358][T22948] [ 1602.525520][T20788] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1602.559795][T20788] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1602.572434][T20788] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1602.621542][T20788] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1602.629243][T20788] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1602.945988][T22980] netlink: 'syz.0.15844': attribute type 13 has an invalid length. [ 1602.973844][T22983] FAULT_INJECTION: forcing a failure. [ 1602.973844][T22983] name failslab, interval 1, probability 0, space 0, times 0 [ 1603.032984][T22983] CPU: 1 UID: 0 PID: 22983 Comm: syz.2.15845 Not tainted syzkaller #0 PREEMPT(full) [ 1603.033008][T22983] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1603.033018][T22983] Call Trace: [ 1603.033025][T22983] [ 1603.033032][T22983] dump_stack_lvl+0xe8/0x150 [ 1603.033062][T22983] should_fail_ex+0x40c/0x560 [ 1603.033085][T22983] should_failslab+0xa8/0x100 [ 1603.033110][T22983] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 1603.033131][T22983] ? alloc_empty_file+0x5b/0x1d0 [ 1603.033148][T22983] ? alloc_empty_file+0x5b/0x1d0 [ 1603.033173][T22983] alloc_empty_file+0x5b/0x1d0 [ 1603.033193][T22983] alloc_file_pseudo+0x115/0x1e0 [ 1603.033215][T22983] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 1603.033243][T22983] anon_inode_getfd+0xc8/0x1f0 [ 1603.033298][T22983] map_create+0x617/0x1b90 [ 1603.033334][T22983] ? __pfx_map_create+0x10/0x10 [ 1603.033362][T22983] ? bpf_lsm_bpf+0x9/0x20 [ 1603.033381][T22983] ? security_bpf+0x7e/0x2d0 [ 1603.033406][T22983] __sys_bpf+0xaea/0xd90 [ 1603.033433][T22983] ? __pfx___sys_bpf+0x10/0x10 [ 1603.033462][T22983] ? __fget_files+0x2a/0x420 [ 1603.033498][T22983] ? ksys_write+0x242/0x270 [ 1603.033523][T22983] ? __pfx_ksys_write+0x10/0x10 [ 1603.033550][T22983] __x64_sys_bpf+0xba/0xd0 [ 1603.033569][T22983] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1603.033595][T22983] do_syscall_64+0x174/0x580 [ 1603.033615][T22983] ? trace_irq_disable+0x3b/0x140 [ 1603.033635][T22983] ? clear_bhb_loop+0x40/0x90 [ 1603.033655][T22983] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1603.033671][T22983] RIP: 0033:0x7f6649f9de59 [ 1603.033688][T22983] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1603.033702][T22983] RSP: 002b:00007f66481f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1603.033720][T22983] RAX: ffffffffffffffda RBX: 00007f664a225fa0 RCX: 00007f6649f9de59 [ 1603.033732][T22983] RDX: 0000000000000048 RSI: 0000200000000640 RDI: 0000000000000000 [ 1603.033742][T22983] RBP: 00007f66481f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1603.033753][T22983] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1603.033762][T22983] R13: 00007f664a226038 R14: 00007f664a225fa0 R15: 00007ffe8cf49bc8 [ 1603.033789][T22983] [ 1603.047532][T22982] netlink: 'syz.3.15846': attribute type 2 has an invalid length. [ 1603.219774][ T4313] net_ratelimit: 94 callbacks suppressed [ 1603.219796][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1603.439542][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1603.447336][ T4310] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1603.467534][T23002] x_tables: unsorted entry at hook 1 [ 1603.553562][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1603.561358][ T4313] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1603.668901][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1603.693171][ T1164] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1603.716015][T22954] rB speed is unknown, defaulting to 1000 [ 1603.760130][T23019] bond0: (slave ip6gre0): Error: Device can not be enslaved while up [ 1603.775272][ T4312] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1603.803089][ T4312] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1603.811155][T23019] tipc: Enabling of bearer rejected, failed to enable media [ 1603.830260][T23020] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 1603.842274][T23022] bond0: (slave ip6gre0): Error: Device can not be enslaved while up [ 1603.882571][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1604.009381][T23026] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1604.040269][T22954] virt_wifi0 speed is unknown, defaulting to 1000 [ 1604.047484][T23028] macvlan2: entered promiscuous mode [ 1604.054873][T23028] macvlan2: entered allmulticast mode [ 1604.062197][T23028] bond2: entered promiscuous mode [ 1604.067791][T23028] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1604.077459][T23028] bond2: left promiscuous mode [ 1604.161714][T23031] 8021q: adding VLAN 0 to HW filter on device team0 [ 1604.169295][T23031] team0: Cannot enslave team device to itself [ 1604.180897][T23033] FAULT_INJECTION: forcing a failure. [ 1604.180897][T23033] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1604.193987][T23033] CPU: 1 UID: 0 PID: 23033 Comm: syz.4.15858 Not tainted syzkaller #0 PREEMPT(full) [ 1604.194013][T23033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1604.194025][T23033] Call Trace: [ 1604.194034][T23033] [ 1604.194043][T23033] dump_stack_lvl+0xe8/0x150 [ 1604.194079][T23033] should_fail_ex+0x40c/0x560 [ 1604.194107][T23033] _copy_from_user+0x2d/0xb0 [ 1604.194136][T23033] kstrtouint_from_user+0xd6/0x180 [ 1604.194163][T23033] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1604.194205][T23033] proc_fail_nth_write+0x8e/0x210 [ 1604.194232][T23033] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1604.194267][T23033] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1604.194292][T23033] vfs_write+0x296/0xba0 [ 1604.194330][T23033] ? __pfx_vfs_write+0x10/0x10 [ 1604.194361][T23033] ? __fget_files+0x2a/0x420 [ 1604.194390][T23033] ? __fget_files+0x3a2/0x420 [ 1604.194414][T23033] ? __fget_files+0x2a/0x420 [ 1604.194446][T23033] ksys_write+0x150/0x270 [ 1604.194478][T23033] ? __pfx_ksys_write+0x10/0x10 [ 1604.194516][T23033] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1604.194549][T23033] do_syscall_64+0x174/0x580 [ 1604.194575][T23033] ? trace_irq_disable+0x3b/0x140 [ 1604.194600][T23033] ? clear_bhb_loop+0x40/0x90 [ 1604.194624][T23033] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1604.194644][T23033] RIP: 0033:0x7f7f0335e68e [ 1604.194663][T23033] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1604.194680][T23033] RSP: 002b:00007f7f0433dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1604.194702][T23033] RAX: ffffffffffffffda RBX: 00007f7f0433e6c0 RCX: 00007f7f0335e68e [ 1604.194717][T23033] RDX: 0000000000000001 RSI: 00007f7f0433e0a0 RDI: 0000000000000003 [ 1604.194730][T23033] RBP: 00007f7f0433e090 R08: 0000000000000000 R09: 0000000000000000 [ 1604.194743][T23033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1604.194754][T23033] R13: 00007f7f03626038 R14: 00007f7f03625fa0 R15: 00007ffd29e3da08 [ 1604.194784][T23033] [ 1604.264188][T23036] netlink: 'syz.3.15859': attribute type 2 has an invalid length. [ 1604.740327][T23051] __nla_validate_parse: 8 callbacks suppressed [ 1604.740356][T23051] netlink: 44 bytes leftover after parsing attributes in process `syz.3.15865'. [ 1604.745281][T20788] Bluetooth: hci5: command tx timeout [ 1606.825444][T20788] Bluetooth: hci5: command tx timeout [ 1607.462301][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1608.113557][ C1] bridge0: port 3(geneve0) entered learning state [ 1608.288171][T31698] net_ratelimit: 114 callbacks suppressed [ 1608.288192][T31698] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1608.321806][T31698] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1608.346189][T31698] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1608.372823][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1608.513536][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1608.604190][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1608.666541][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1608.708567][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1608.738033][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1608.762602][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1608.910732][T20788] Bluetooth: hci5: command tx timeout [ 1609.032204][T23067] rB speed is unknown, defaulting to 1000 [ 1609.043153][T23061] syzkaller0: entered promiscuous mode [ 1609.048670][T23061] syzkaller0: entered allmulticast mode [ 1609.092410][T23061] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1609.144596][T22954] bridge0: port 1(bridge_slave_0) entered blocking state [ 1609.161485][T22954] bridge0: port 1(bridge_slave_0) entered disabled state [ 1609.179463][T22954] bridge_slave_0: entered allmulticast mode [ 1609.204689][T22954] bridge_slave_0: entered promiscuous mode [ 1609.381514][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 1609.390791][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 1609.437975][T22954] bridge0: port 2(bridge_slave_1) entered blocking state [ 1609.446605][T22954] bridge0: port 2(bridge_slave_1) entered disabled state [ 1609.454150][T22954] bridge_slave_1: entered allmulticast mode [ 1609.467147][T22954] bridge_slave_1: entered promiscuous mode [ 1609.488852][T23067] virt_wifi0 speed is unknown, defaulting to 1000 [ 1609.523005][T22954] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1609.558202][T22954] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1609.565490][T23084] netlink: 'syz.4.15876': attribute type 3 has an invalid length. [ 1609.592087][T23084] netlink: 'syz.4.15876': attribute type 1 has an invalid length. [ 1609.600148][T23084] netlink: 204 bytes leftover after parsing attributes in process `syz.4.15876'. [ 1609.656024][T22954] team0: Port device team_slave_0 added [ 1609.664049][T22954] team0: Port device team_slave_1 added [ 1609.701194][T22954] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1609.708821][T22954] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1609.735055][T22954] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1609.747933][T22954] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1609.755081][T22954] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1609.781831][T22954] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1610.074369][T22954] hsr_slave_0: entered promiscuous mode [ 1610.083188][T22954] hsr_slave_1: entered promiscuous mode [ 1610.092444][T22954] debugfs: 'hsr0' already exists in 'hsr' [ 1610.098215][T22954] Cannot create hsr debugfs directory [ 1610.269043][T23095] syzkaller0: entered promiscuous mode [ 1610.274561][T23095] syzkaller0: entered allmulticast mode [ 1610.481355][T23105] netlink: 20 bytes leftover after parsing attributes in process `syz.0.15885'. [ 1610.538374][T22954] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1610.549255][T22954] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 1610.559470][T22954] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1610.581068][T22954] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 1610.659867][ T29] audit: type=1107 audit(1783504317.570:25): pid=23106 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ً5%UA٠0ltݕ/ 6򊨊' [ 1610.879384][T22954] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1610.892626][T22954] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 1610.916869][T22954] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1610.929825][T22954] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 1610.982675][T20788] Bluetooth: hci5: command tx timeout [ 1611.081858][T23129] netlink: 4 bytes leftover after parsing attributes in process `syz.4.15891'. [ 1611.218390][T22954] bond0: (slave netdevsim1): Releasing backup interface [ 1611.253543][T23137] netlink: 8 bytes leftover after parsing attributes in process `syz.4.15891'. [ 1611.304666][T22954] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1611.340777][T22954] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 1611.373888][T22954] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1611.403044][T22954] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 1611.558239][T23129] hsr_slave_1 (unregistering): left promiscuous mode [ 1611.621136][T23152] netlink: 16 bytes leftover after parsing attributes in process `syz.0.15899'. [ 1611.720137][T22954] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1611.732363][T22954] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 1611.748399][T22954] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1611.759868][T22954] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 1612.469138][T23178] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15905'. [ 1612.528781][T22954] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1612.554638][T22954] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1612.566291][T23178] netlink: 'syz.3.15905': attribute type 1 has an invalid length. [ 1612.574164][T23178] netlink: 28 bytes leftover after parsing attributes in process `syz.3.15905'. [ 1612.591653][T22954] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1612.596707][T23185] netlink: 16 bytes leftover after parsing attributes in process `syz.4.15909'. [ 1612.620210][T22954] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1612.633914][T22954] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1612.644629][T22954] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1612.670781][T23178] bond9: (slave syz_tun): Enslaving as an active interface with an up link [ 1612.679695][T22954] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1612.692508][T23192] netlink: 20 bytes leftover after parsing attributes in process `syz.4.15912'. [ 1612.714628][T22954] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1612.765890][T23178] bond9: (slave syz_tun): Releasing backup interface [ 1612.842098][T23178] bond0: (slave dummy0): Releasing backup interface [ 1612.857300][T23178] bridge_slave_0: left promiscuous mode [ 1612.876489][T23178] bridge0: port 1(bridge_slave_0) entered disabled state [ 1612.913216][T23178] bridge_slave_1: left allmulticast mode [ 1612.949977][T23178] bridge_slave_1: left promiscuous mode [ 1612.956643][T23178] bridge0: port 2(bridge_slave_1) entered disabled state [ 1612.961364][T23209] netlink: 'syz.0.15919': attribute type 1 has an invalid length. [ 1612.974822][T23178] bond8: (slave veth0_to_bond): Releasing backup interface [ 1612.988484][T23178] bond0: (slave bond_slave_0): Releasing backup interface [ 1612.997356][T23178] bond0: (slave bond_slave_1): Releasing backup interface [ 1613.006794][T23178] team0: Port device team_slave_0 removed [ 1613.014080][T23178] team0: Port device team_slave_1 removed [ 1613.020249][T23178] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1613.028389][T23178] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1613.112655][T23209] bond5: entered promiscuous mode [ 1613.118194][T23209] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1613.221088][T23221] netlink: 16 bytes leftover after parsing attributes in process `syz.3.15921'. [ 1613.254588][T22954] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1613.302333][T22954] 8021q: adding VLAN 0 to HW filter on device team0 [ 1613.312268][ T4318] net_ratelimit: 109 callbacks suppressed [ 1613.312289][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1613.330314][ T4318] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1613.345495][ T4313] bridge0: port 1(bridge_slave_0) entered blocking state [ 1613.352895][ T4313] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1613.392806][T23227] netlink: 20 bytes leftover after parsing attributes in process `syz.3.15924'. [ 1613.404850][ T1164] bridge0: port 2(bridge_slave_1) entered blocking state [ 1613.412083][ T1164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1613.436268][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1613.489684][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1613.518895][ T4318] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1613.662794][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1613.720717][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1613.767330][ T4312] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1613.818351][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1613.850269][ T4318] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1614.389149][T23278] syzkaller0: entered promiscuous mode [ 1614.411524][T23278] syzkaller0: entered allmulticast mode [ 1614.507517][T22954] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1614.614947][T22954] veth0_vlan: entered promiscuous mode [ 1614.632183][T22954] veth1_vlan: entered promiscuous mode [ 1614.684226][T22954] veth0_macvtap: entered promiscuous mode [ 1614.697912][T22954] veth1_macvtap: entered promiscuous mode [ 1614.706230][T23286] netlink: 'syz.4.15942': attribute type 62 has an invalid length. [ 1614.749887][T22954] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1614.772705][T22954] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1614.789950][ T4312] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1614.814685][ T4312] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1614.902236][ T4312] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1614.936938][ T4312] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1615.061860][ T4313] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1615.070156][ T4313] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1615.126440][ T4318] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1615.160039][ T4318] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1615.345735][T23311] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 1615.443271][T23311] netlink: 'syz.2.15952': attribute type 5 has an invalid length. [ 1615.478652][T23311] geneve2: entered promiscuous mode [ 1615.502605][T23311] geneve2: entered allmulticast mode [ 1615.517146][ T4312] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 1615.533457][ T4312] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 1615.571377][ T4312] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 1615.597328][T23320] netlink: 'syz.1.15836': attribute type 3 has an invalid length. [ 1615.604414][T23323] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1615.632876][T23320] __nla_validate_parse: 7 callbacks suppressed [ 1615.632895][T23320] netlink: 32 bytes leftover after parsing attributes in process `syz.1.15836'. [ 1615.733192][T23323] bridge0: port 4(ipvlan2) entered blocking state [ 1615.739922][T23323] bridge0: port 4(ipvlan2) entered disabled state [ 1615.746832][T23323] ipvlan2: entered allmulticast mode [ 1615.752148][T23323] bridge0: entered allmulticast mode [ 1615.760167][T23323] ipvlan2: left allmulticast mode [ 1615.765498][T23323] bridge0: left allmulticast mode [ 1615.875040][T23336] netlink: 44 bytes leftover after parsing attributes in process `syz.1.15960'. [ 1615.996257][T23340] netlink: 'syz.1.15961': attribute type 4 has an invalid length. [ 1616.303145][ T5641] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1616.320994][ T5641] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1616.330061][ T5641] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1616.343681][ T5641] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1616.374084][T23353] xt_hashlimit: size too large, truncated to 1048576 [ 1616.382820][ T5641] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1616.512593][T23358] bridge0: port 1(bridge_slave_0) entered disabled state [ 1616.646382][T23358] bridge_slave_0 (unregistering): left allmulticast mode [ 1616.653475][T23358] bridge_slave_0 (unregistering): left promiscuous mode [ 1616.668631][T23358] bridge0: port 1(bridge_slave_0) entered disabled state [ 1616.723197][T23366] netlink: 'syz.1.15970': attribute type 2 has an invalid length. [ 1616.928008][T23375] netlink: 32 bytes leftover after parsing attributes in process `syz.2.15972'. [ 1617.376834][T23403] netlink: 'syz.4.15982': attribute type 2 has an invalid length. [ 1617.420784][T23347] rB speed is unknown, defaulting to 1000 [ 1617.438527][T23405] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15984'. [ 1617.750126][T23347] virt_wifi0 speed is unknown, defaulting to 1000 [ 1617.957008][T23432] netlink: 'syz.2.15993': attribute type 2 has an invalid length. [ 1618.322314][ T4313] net_ratelimit: 80 callbacks suppressed [ 1618.322351][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1618.385851][T23450] netlink: 240 bytes leftover after parsing attributes in process `syz.2.15998'. [ 1618.387007][ T4313] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1618.464419][T20788] Bluetooth: hci4: command tx timeout [ 1618.627201][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1618.681518][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1618.711932][T23462] netlink: 'syz.2.16003': attribute type 4 has an invalid length. [ 1618.744995][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1618.793898][T23468] netlink: 'syz.1.16004': attribute type 5 has an invalid length. [ 1618.831190][T23347] bridge0: port 1(bridge_slave_0) entered blocking state [ 1618.862650][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1618.918182][T23347] bridge0: port 1(bridge_slave_0) entered disabled state [ 1618.925602][T23347] bridge_slave_0: entered allmulticast mode [ 1618.932798][T23347] bridge_slave_0: entered promiscuous mode [ 1618.952234][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1618.973661][T23347] bridge0: port 2(bridge_slave_1) entered blocking state [ 1618.980934][T23347] bridge0: port 2(bridge_slave_1) entered disabled state [ 1618.988284][T23347] bridge_slave_1: entered allmulticast mode [ 1618.996428][T23347] bridge_slave_1: entered promiscuous mode [ 1619.011569][ T4312] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1619.087016][ T4312] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1619.148247][T23486] netlink: 'syz.0.16010': attribute type 1 has an invalid length. [ 1619.156209][T23486] netlink: 76 bytes leftover after parsing attributes in process `syz.0.16010'. [ 1619.173509][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1619.180127][ T9271] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1619.200962][T23347] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1619.219759][T23347] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1619.255201][T23487] bridge0: port 3(vlan2) entered blocking state [ 1619.261894][T23487] bridge0: port 3(vlan2) entered disabled state [ 1619.268815][T23487] vlan2: entered allmulticast mode [ 1619.274267][T23487] geneve0: entered allmulticast mode [ 1619.281592][T23487] vlan2: entered promiscuous mode [ 1619.286790][T23487] geneve0: entered promiscuous mode [ 1619.323285][T23347] team0: Port device team_slave_0 added [ 1619.333311][T23347] team0: Port device team_slave_1 added [ 1619.382165][T23347] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1619.389153][T23347] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1619.439394][T23347] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1619.461610][T23347] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1619.468601][T23347] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1619.494851][T23347] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1619.618882][T23347] hsr_slave_0: entered promiscuous mode [ 1619.625887][T23347] hsr_slave_1: entered promiscuous mode [ 1619.632560][T23347] debugfs: 'hsr0' already exists in 'hsr' [ 1619.680740][T23347] Cannot create hsr debugfs directory [ 1619.812261][T16317] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1619.846517][T23508] validate_nla: 3 callbacks suppressed [ 1619.846535][T23508] netlink: 'syz.2.16019': attribute type 2 has an invalid length. [ 1619.959739][T23347] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1620.028535][T23514] netlink: 20 bytes leftover after parsing attributes in process `syz.2.16021'. [ 1620.039935][T23510] netlink: 4 bytes leftover after parsing attributes in process `syz.0.16018'. [ 1620.097960][T23515] netlink: 'syz.0.16018': attribute type 1 has an invalid length. [ 1620.306940][T23347] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1620.362576][T23525] netlink: 5120 bytes leftover after parsing attributes in process `syz.0.16025'. [ 1620.533004][T20788] Bluetooth: hci4: command tx timeout [ 1620.670795][T23347] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1620.788029][T23539] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input7 [ 1620.881462][T23347] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1620.993618][T23551] syzkaller1: entered promiscuous mode [ 1620.999194][T23551] syzkaller1: entered allmulticast mode [ 1621.251658][T23347] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1621.267939][T23347] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1621.280974][T23347] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1621.296390][T23347] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1621.308901][T23347] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1621.330166][T23347] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1621.364652][T23347] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1621.395518][T23347] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1621.424069][T23576] netlink: 'syz.4.16038': attribute type 2 has an invalid length. [ 1621.469221][T23579] netlink: 16 bytes leftover after parsing attributes in process `syz.2.16039'. [ 1621.558028][T23347] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1621.584139][T23347] 8021q: adding VLAN 0 to HW filter on device team0 [ 1621.623919][ T4310] bridge0: port 1(bridge_slave_0) entered blocking state [ 1621.631097][ T4310] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1621.647521][ T4313] bridge0: port 2(bridge_slave_1) entered blocking state [ 1621.654697][ T4313] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1621.773369][T23347] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1621.783847][T23347] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1622.445631][T23347] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1622.505439][T23347] veth0_vlan: entered promiscuous mode [ 1622.532890][T23347] veth1_vlan: entered promiscuous mode [ 1622.572565][T23347] veth0_macvtap: entered promiscuous mode [ 1622.584335][T23347] veth1_macvtap: entered promiscuous mode [ 1622.592105][T20788] Bluetooth: hci4: command tx timeout [ 1622.625803][T23347] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1622.635953][T23626] netlink: 4 bytes leftover after parsing attributes in process `syz.0.16049'. [ 1622.664881][T23347] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1622.676333][T23628] bridge: RTM_NEWNEIGH with invalid state 0x20 [ 1622.687294][ T4310] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1622.698404][ T4310] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1622.718016][ T4310] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1622.726825][ T4310] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1622.911231][ T4313] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1622.928771][ T4313] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1623.012376][ T1164] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1623.021033][ T1164] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1623.065598][T23638] netlink: 'syz.2.16054': attribute type 39 has an invalid length. [ 1623.073918][T23638] hsr_slave_0: left promiscuous mode [ 1623.080638][T23638] hsr_slave_1: left promiscuous mode [ 1623.351463][ T4310] net_ratelimit: 80 callbacks suppressed [ 1623.351483][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1623.414989][ T4310] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1623.463079][ C1] bridge0: port 3(geneve0) entered forwarding state [ 1623.470614][ C1] bridge0: topology change detected, propagating [ 1623.518504][T23654] netlink: 8 bytes leftover after parsing attributes in process `syz.0.16058'. [ 1623.542858][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1623.559922][ T1164] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1623.703648][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1623.714077][ T1164] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1623.833862][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1623.852076][ T4313] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1623.907761][T23674] netlink: 64 bytes leftover after parsing attributes in process `syz.4.16063'. [ 1623.963523][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1623.976596][ T1164] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1623.976879][T23674] netlink: 32 bytes leftover after parsing attributes in process `syz.4.16063'. [ 1624.002734][T23678] netlink: 'syz.0.16065': attribute type 2 has an invalid length. [ 1624.011666][T23674] netlink: 'syz.4.16063': attribute type 3 has an invalid length. [ 1624.161863][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1624.256029][T14282] IPVS: starting estimator thread 0... [ 1624.520704][T23688] IPVS: using max 56 ests per chain, 134400 per kthread [ 1624.588102][T23707] tls_set_device_offload_rx: netdev not found [ 1624.650396][T23713] netlink: 40 bytes leftover after parsing attributes in process `syz.0.16075'. [ 1624.664318][T23715] netlink: 'syz.4.16076': attribute type 2 has an invalid length. [ 1624.682842][ T5641] Bluetooth: hci4: command tx timeout [ 1624.718562][T23717] vlan2: entered promiscuous mode [ 1624.723652][T23717] geneve1: entered promiscuous mode [ 1624.753727][T23720] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1624.779522][T23717] vlan2: entered allmulticast mode [ 1624.784786][T23717] geneve1: entered allmulticast mode [ 1624.791432][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1624.794500][T23720] xt_hashlimit: size too large, truncated to 1048576 [ 1624.798739][ C0] bridge0: topology change detected, propagating [ 1624.812151][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1624.819681][ C0] bridge0: topology change detected, propagating [ 1624.909023][T23726] sctp: [Deprecated]: syz.3.16080 (pid 23726) Use of int in maxseg socket option. [ 1624.909023][T23726] Use struct sctp_assoc_value instead [ 1625.073226][T20788] Bluetooth: hci1: command 0x0406 tx timeout [ 1625.386796][T23745] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16087'. [ 1625.413476][T23745] block nbd6: Unsupported socket: should be TCP or UNIX. [ 1625.461612][T23749] netlink: 'syz.3.16089': attribute type 2 has an invalid length. [ 1625.719265][T23742] erspan0: entered promiscuous mode [ 1625.724538][T23742] erspan0: entered allmulticast mode [ 1626.298799][T23795] netlink: 'syz.2.16101': attribute type 2 has an invalid length. [ 1626.418646][T23800] netlink: 12 bytes leftover after parsing attributes in process `syz.2.16103'. [ 1626.678577][T23820] syzkaller0: entered promiscuous mode [ 1626.684165][T23820] syzkaller0: entered allmulticast mode [ 1626.725902][T23822] netlink: 140 bytes leftover after parsing attributes in process `syz.3.16111'. [ 1626.785550][T23820] netlink: 'syz.2.16110': attribute type 13 has an invalid length. [ 1627.001039][T23840] netlink: 24 bytes leftover after parsing attributes in process `syz.1.16114'. [ 1627.038592][T23830] "syz.1.16114" (23830) uses obsolete ecb(arc4) skcipher [ 1627.093927][ T997] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1627.108093][T23837] tipc: Enabled bearer , priority 0 [ 1627.206230][T23819] tipc: Resetting bearer [ 1627.273100][T23851] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16114'. [ 1627.282087][T23851] netlink: 12 bytes leftover after parsing attributes in process `syz.1.16114'. [ 1627.354267][T23819] tipc: Disabling bearer [ 1627.413344][T14282] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1627.464436][T23854] syzkaller1: entered promiscuous mode [ 1627.491384][T23854] syzkaller1: entered allmulticast mode [ 1627.514451][T23864] netlink: 8 bytes leftover after parsing attributes in process `syz.3.16123'. [ 1627.524015][T23864] netlink: 24 bytes leftover after parsing attributes in process `syz.3.16123'. [ 1627.564134][T23865] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16124'. [ 1627.628648][T23870] netlink: 'syz.1.16122': attribute type 1 has an invalid length. [ 1627.779585][T23884] netlink: 16 bytes leftover after parsing attributes in process `syz.1.16129'. [ 1628.004702][T23892] netlink: 20 bytes leftover after parsing attributes in process `syz.3.16133'. [ 1628.013836][T23892] netlink: 28 bytes leftover after parsing attributes in process `syz.3.16133'. [ 1628.379013][T23911] FAULT_INJECTION: forcing a failure. [ 1628.379013][T23911] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1628.392184][T23911] CPU: 1 UID: 0 PID: 23911 Comm: syz.2.16141 Not tainted syzkaller #0 PREEMPT(full) [ 1628.392216][T23911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1628.392228][T23911] Call Trace: [ 1628.392236][T23911] [ 1628.392244][T23911] dump_stack_lvl+0xe8/0x150 [ 1628.392277][T23911] should_fail_ex+0x40c/0x560 [ 1628.392303][T23911] _copy_from_iter+0x3b0/0x1660 [ 1628.392336][T23911] ? __pfx__copy_from_iter+0x10/0x10 [ 1628.392362][T23911] ? dev_get_by_index+0x22/0x2d0 [ 1628.392380][T23911] ? dev_get_by_index+0x22/0x2d0 [ 1628.392405][T23911] packet_sendmsg+0x2f1d/0x5040 [ 1628.392427][T23911] ? aa_label_sk_perm+0x532/0x6e0 [ 1628.392457][T23911] ? __lock_acquire+0x683/0x2cf0 [ 1628.392491][T23911] ? __lock_acquire+0x683/0x2cf0 [ 1628.392528][T23911] ? unwind_next_frame+0x8f/0x2550 [ 1628.392562][T23911] ? __pfx_packet_sendmsg+0x10/0x10 [ 1628.392589][T23911] ? __pfx_aa_sk_perm+0x10/0x10 [ 1628.392618][T23911] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1628.392641][T23911] ? __pfx_packet_sendmsg+0x10/0x10 [ 1628.392658][T23911] sock_sendmsg_nosec+0x13a/0x180 [ 1628.392683][T23911] ____sys_sendmsg+0x54e/0x850 [ 1628.392714][T23911] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1628.392748][T23911] ? import_iovec+0x73/0xa0 [ 1628.392776][T23911] ___sys_sendmsg+0x2a5/0x360 [ 1628.392800][T23911] ? __lock_acquire+0x683/0x2cf0 [ 1628.392825][T23911] ? __pfx____sys_sendmsg+0x10/0x10 [ 1628.392883][T23911] ? __fget_files+0x2a/0x420 [ 1628.392907][T23911] ? __fget_files+0x3a2/0x420 [ 1628.392938][T23911] __x64_sys_sendmsg+0x1b1/0x290 [ 1628.392965][T23911] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1628.393006][T23911] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1628.393026][T23911] do_syscall_64+0x174/0x580 [ 1628.393049][T23911] ? trace_irq_disable+0x3b/0x140 [ 1628.393070][T23911] ? clear_bhb_loop+0x40/0x90 [ 1628.393093][T23911] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1628.393111][T23911] RIP: 0033:0x7f6649f9de59 [ 1628.393130][T23911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1628.393147][T23911] RSP: 002b:00007f66481f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1628.393169][T23911] RAX: ffffffffffffffda RBX: 00007f664a225fa0 RCX: 00007f6649f9de59 [ 1628.393181][T23911] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1628.393193][T23911] RBP: 00007f66481f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1628.393227][T23911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1628.393239][T23911] R13: 00007f664a226038 R14: 00007f664a225fa0 R15: 00007ffe8cf49bc8 [ 1628.393267][T23911] [ 1628.393415][ T4318] net_ratelimit: 76 callbacks suppressed [ 1628.393428][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1628.728149][T31698] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1628.812978][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1628.890833][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1628.940342][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1628.999594][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1629.063533][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1629.127068][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1629.169851][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1629.242750][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1633.390597][T23926] __nla_validate_parse: 1 callbacks suppressed [ 1633.390619][T23926] netlink: 16 bytes leftover after parsing attributes in process `syz.0.16148'. [ 1633.494076][ T4312] net_ratelimit: 117 callbacks suppressed [ 1633.494096][ T4312] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1633.527121][ T4312] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1633.547871][T23933] --map-set only usable from mangle table [ 1633.672732][T23938] lo: Caught tx_queue_len zero misconfig [ 1633.712627][T23938] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 1633.759702][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1633.821595][T31698] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1633.899105][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1633.907063][ T4313] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1633.942766][T23958] netlink: 52 bytes leftover after parsing attributes in process `syz.0.16159'. [ 1633.962094][T23958] netlink: 44 bytes leftover after parsing attributes in process `syz.0.16159'. [ 1633.987615][T31698] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1633.996743][T23961] netlink: 16 bytes leftover after parsing attributes in process `syz.3.16162'. [ 1634.032325][T31698] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1634.047546][T31698] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1634.142414][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1634.184147][T23973] IPv6: sit2: Disabled Multicast RS [ 1634.196508][T23973] sit2: entered allmulticast mode [ 1634.586834][T23993] FAULT_INJECTION: forcing a failure. [ 1634.586834][T23993] name failslab, interval 1, probability 0, space 0, times 0 [ 1634.599668][T23993] CPU: 1 UID: 0 PID: 23993 Comm: syz.4.16172 Not tainted syzkaller #0 PREEMPT(full) [ 1634.599693][T23993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1634.599703][T23993] Call Trace: [ 1634.599711][T23993] [ 1634.599720][T23993] dump_stack_lvl+0xe8/0x150 [ 1634.599752][T23993] should_fail_ex+0x40c/0x560 [ 1634.599779][T23993] should_failslab+0xa8/0x100 [ 1634.599808][T23993] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 1634.599831][T23993] ? skb_clone+0x212/0x3a0 [ 1634.599856][T23993] ? skb_clone+0x212/0x3a0 [ 1634.599889][T23993] skb_clone+0x212/0x3a0 [ 1634.599920][T23993] __netlink_deliver_tap+0x413/0x860 [ 1634.599958][T23993] ? netlink_deliver_tap+0x2e/0x1b0 [ 1634.599986][T23993] netlink_deliver_tap+0x19c/0x1b0 [ 1634.600012][T23993] netlink_unicast+0x77f/0x940 [ 1634.600046][T23993] netlink_sendmsg+0x813/0xb40 [ 1634.600082][T23993] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1634.600116][T23993] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1634.600141][T23993] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1634.600166][T23993] sock_sendmsg_nosec+0x13a/0x180 [ 1634.600188][T23993] ____sys_sendmsg+0x54e/0x850 [ 1634.600218][T23993] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1634.600253][T23993] ? import_iovec+0x73/0xa0 [ 1634.600281][T23993] ___sys_sendmsg+0x2a5/0x360 [ 1634.600305][T23993] ? __lock_acquire+0x683/0x2cf0 [ 1634.600331][T23993] ? __pfx____sys_sendmsg+0x10/0x10 [ 1634.600390][T23993] ? __fget_files+0x2a/0x420 [ 1634.600414][T23993] ? __fget_files+0x3a2/0x420 [ 1634.600446][T23993] __x64_sys_sendmsg+0x1b1/0x290 [ 1634.600489][T23993] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1634.600533][T23993] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1634.600554][T23993] do_syscall_64+0x174/0x580 [ 1634.600577][T23993] ? trace_irq_disable+0x3b/0x140 [ 1634.600601][T23993] ? clear_bhb_loop+0x40/0x90 [ 1634.600624][T23993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1634.600642][T23993] RIP: 0033:0x7f7f0339de59 [ 1634.600660][T23993] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1634.600676][T23993] RSP: 002b:00007f7f0433e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1634.600696][T23993] RAX: ffffffffffffffda RBX: 00007f7f03625fa0 RCX: 00007f7f0339de59 [ 1634.600710][T23993] RDX: 0000000000044000 RSI: 0000200000000200 RDI: 0000000000000003 [ 1634.600723][T23993] RBP: 00007f7f0433e090 R08: 0000000000000000 R09: 0000000000000000 [ 1634.600735][T23993] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1634.600747][T23993] R13: 00007f7f03626038 R14: 00007f7f03625fa0 R15: 00007ffd29e3da08 [ 1634.600779][T23993] [ 1634.972542][T24009] tipc: Started in network mode [ 1634.977660][T24009] tipc: Node identity 821a0a98c60d, cluster identity 4711 [ 1634.985217][T24009] tipc: Enabled bearer , priority 0 [ 1635.000168][T24009] netlink: 76 bytes leftover after parsing attributes in process `syz.3.16176'. [ 1635.038551][T24008] tipc: Resetting bearer [ 1635.062484][T24008] tipc: Disabling bearer [ 1635.761868][T24069] netlink: 24 bytes leftover after parsing attributes in process `syz.1.16194'. [ 1636.123145][T24097] netlink: 44 bytes leftover after parsing attributes in process `syz.0.16204'. [ 1637.156582][T24112] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16207'. [ 1637.166557][T24112] netlink: 24 bytes leftover after parsing attributes in process `syz.4.16207'. [ 1638.537759][ T4318] net_ratelimit: 109 callbacks suppressed [ 1638.537782][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1638.576097][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1638.602519][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1638.627791][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1638.652550][ T4317] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1638.702307][ T4317] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1638.725918][ T4317] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1638.753019][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1638.787676][ T4313] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1638.816836][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1640.649623][T24111] netlink: 'syz.4.16207': attribute type 8 has an invalid length. [ 1640.657777][T24111] sch_fq: defrate 0 ignored. [ 1640.875239][T24130] netlink: 'syz.4.16212': attribute type 11 has an invalid length. [ 1641.176555][T24101] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1641.183016][T24101] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 1641.348295][T24156] netlink: 44 bytes leftover after parsing attributes in process `syz.0.16218'. [ 1641.376202][T24101] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1641.384294][T24101] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 1641.420074][T24158] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16219'. [ 1641.437566][T24163] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16220'. [ 1641.643942][T24158] team0: Port device team_slave_0 removed [ 1641.694516][T24173] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16224'. [ 1641.805038][T24101] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1641.811269][T24101] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 1641.910707][T24158] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16219'. [ 1641.953992][T24158] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16219'. [ 1641.954168][T24101] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1641.963256][T24158] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16219'. [ 1641.980641][T24101] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 1642.011482][T24158] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16219'. [ 1642.025009][T24182] x_tables: duplicate entry at hook 3 [ 1642.061918][T24158] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16219'. [ 1642.073087][T24158] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16219'. [ 1642.206538][T24188] netlink: 'syz.1.16229': attribute type 1 has an invalid length. [ 1642.313476][T24188] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 1643.054349][T24236] netlink: 'syz.3.16246': attribute type 21 has an invalid length. [ 1643.169719][T24236] bond1: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 1643.185952][T24236] bond1 (unregistering): Released all slaves [ 1643.583551][ T1164] net_ratelimit: 111 callbacks suppressed [ 1643.583572][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1643.597052][ T1164] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1643.617447][T24266] netlink: 'syz.3.16249': attribute type 1 has an invalid length. [ 1643.754744][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1643.777748][ T1164] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1643.874365][ T4317] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1643.886715][ T4317] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1644.019040][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1644.088502][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1644.096293][ T1164] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1644.200950][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1644.342871][T24313] netlink: 'syz.2.16266': attribute type 2 has an invalid length. [ 1644.563602][T20788] block nbd0: Receive control failed (result -107) [ 1644.597208][T24320] block nbd0: reconnected socket [ 1644.817954][T24335] FAULT_INJECTION: forcing a failure. [ 1644.817954][T24335] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1644.835785][T24335] CPU: 1 UID: 0 PID: 24335 Comm: syz.0.16278 Not tainted syzkaller #0 PREEMPT(full) [ 1644.835826][T24335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1644.835837][T24335] Call Trace: [ 1644.835846][T24335] [ 1644.835854][T24335] dump_stack_lvl+0xe8/0x150 [ 1644.835889][T24335] should_fail_ex+0x40c/0x560 [ 1644.835915][T24335] _copy_from_user+0x2d/0xb0 [ 1644.835942][T24335] kstrtouint_from_user+0xd6/0x180 [ 1644.835967][T24335] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1644.836004][T24335] proc_fail_nth_write+0x8e/0x210 [ 1644.836029][T24335] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1644.836062][T24335] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1644.836081][T24335] vfs_write+0x296/0xba0 [ 1644.836115][T24335] ? __pfx_vfs_write+0x10/0x10 [ 1644.836143][T24335] ? __fget_files+0x2a/0x420 [ 1644.836171][T24335] ? __fget_files+0x3a2/0x420 [ 1644.836194][T24335] ? __fget_files+0x2a/0x420 [ 1644.836226][T24335] ksys_write+0x150/0x270 [ 1644.836255][T24335] ? __pfx_ksys_write+0x10/0x10 [ 1644.836291][T24335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1644.836312][T24335] do_syscall_64+0x174/0x580 [ 1644.836337][T24335] ? trace_irq_disable+0x3b/0x140 [ 1644.836362][T24335] ? clear_bhb_loop+0x40/0x90 [ 1644.836386][T24335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1644.836406][T24335] RIP: 0033:0x7f25cf15e68e [ 1644.836424][T24335] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1644.836442][T24335] RSP: 002b:00007f25d00dafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1644.836463][T24335] RAX: ffffffffffffffda RBX: 00007f25d00db6c0 RCX: 00007f25cf15e68e [ 1644.836478][T24335] RDX: 0000000000000001 RSI: 00007f25d00db0a0 RDI: 0000000000000004 [ 1644.836490][T24335] RBP: 00007f25d00db090 R08: 0000000000000000 R09: 0000000000000000 [ 1644.836503][T24335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1644.836515][T24335] R13: 00007f25cf426038 R14: 00007f25cf425fa0 R15: 00007fff9e6f4a98 [ 1644.836549][T24335] [ 1644.839163][T24337] netlink: 'syz.3.16277': attribute type 5 has an invalid length. [ 1645.026158][T24349] netlink: 'syz.4.16281': attribute type 2 has an invalid length. [ 1645.596867][T24381] netlink: 'syz.1.16290': attribute type 1 has an invalid length. [ 1645.617813][T24379] xt_nfacct: accounting object `syz1' does not exist [ 1645.652639][T24381] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1646.076081][T24402] netlink: 'syz.2.16294': attribute type 2 has an invalid length. [ 1646.392065][T24409] __nla_validate_parse: 18 callbacks suppressed [ 1646.392084][T24409] netlink: 19 bytes leftover after parsing attributes in process `syz.4.16297'. [ 1646.419962][T24421] netlink: 20 bytes leftover after parsing attributes in process `syz.1.16299'. [ 1646.429053][T24421] netlink: 20 bytes leftover after parsing attributes in process `syz.1.16299'. [ 1646.538236][T24432] vlan0: Caught tx_queue_len zero misconfig [ 1646.540138][T24420] netlink: 20 bytes leftover after parsing attributes in process `syz.1.16299'. [ 1646.553396][T24420] netlink: 20 bytes leftover after parsing attributes in process `syz.1.16299'. [ 1646.632996][T24420] geneve2: entered promiscuous mode [ 1646.674671][T24439] pim6reg: entered allmulticast mode [ 1646.733248][T24437] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16303'. [ 1646.776754][T24443] netlink: 20 bytes leftover after parsing attributes in process `syz.4.16304'. [ 1646.826363][T24446] sctp: [Deprecated]: syz.1.16306 (pid 24446) Use of int in max_burst socket option. [ 1646.826363][T24446] Use struct sctp_assoc_value instead [ 1646.913940][T24441] bond1: invalid ARP target 0.0.0.0 specified for addition [ 1646.922528][T24451] netlink: 'syz.2.16307': attribute type 2 has an invalid length. [ 1646.930497][T24441] bond1: option arp_ip_target: invalid value (0) [ 1646.980360][T24441] bond1 (unregistering): Released all slaves [ 1647.282297][T24468] netlink: 4 bytes leftover after parsing attributes in process `syz.2.16314'. [ 1647.304984][T24468] netlink: 19 bytes leftover after parsing attributes in process `syz.2.16314'. [ 1647.368429][T24473] netlink: 36 bytes leftover after parsing attributes in process `syz.4.16316'. [ 1647.506982][T24475] sctp: [Deprecated]: syz.1.16315 (pid 24475) Use of int in maxseg socket option. [ 1647.506982][T24475] Use struct sctp_assoc_value instead [ 1647.615915][T24486] netlink: 'syz.0.16319': attribute type 1 has an invalid length. [ 1647.721653][T24490] macvlan2: entered promiscuous mode [ 1647.727120][T24490] macvlan2: entered allmulticast mode [ 1647.734562][T24490] bond6: entered promiscuous mode [ 1647.743247][T24490] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1647.760019][T24490] bond6: left promiscuous mode [ 1647.850002][T24502] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1647.861343][T24502] IPVS: set_ctl: invalid protocol: 17893 0.0.0.0:20001 [ 1648.069196][T24513] netlink: 'syz.4.16328': attribute type 4 has an invalid length. [ 1648.324024][T24529] netlink: 'syz.4.16334': attribute type 2 has an invalid length. [ 1648.457451][T24538] netlink: 'syz.2.16337': attribute type 10 has an invalid length. [ 1648.505312][T24538] bond0: Caught tx_queue_len zero misconfig [ 1648.602327][ T1164] net_ratelimit: 75 callbacks suppressed [ 1648.602348][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1648.652084][ T4312] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1648.660029][ T4312] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1648.683881][T24552] syzkaller0: entered promiscuous mode [ 1648.689402][T24552] syzkaller0: entered allmulticast mode [ 1648.763653][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1648.779577][ T1164] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1648.873178][ T4317] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1648.923546][ T4317] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1648.982366][ T4317] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1649.031575][ T1164] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1649.044161][ T1164] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1649.538300][T24597] netlink: 'syz.0.16356': attribute type 16 has an invalid length. [ 1649.568962][T24597] netlink: 'syz.0.16356': attribute type 17 has an invalid length. [ 1649.598588][T24597] gre0: left promiscuous mode [ 1649.614158][T24597] gre0: left allmulticast mode [ 1649.851035][T24618] xt_l2tp: invalid flags combination: 0 [ 1650.024246][T24618] bridge0: port 2(bridge_slave_1) entered disabled state [ 1650.038774][T24618] bridge0: port 1(bridge_slave_0) entered disabled state [ 1650.103938][T24628] dvmrp0: left allmulticast mode [ 1650.175086][T24629] netlink: 'syz.2.16364': attribute type 1 has an invalid length. [ 1650.199072][T24629] netlink: 'syz.2.16364': attribute type 2 has an invalid length. [ 1651.914292][ T4318] [ 1651.916669][ T4318] ====================================================== [ 1651.923691][ T4318] WARNING: possible circular locking dependency detected [ 1651.930730][ T4318] syzkaller #0 Not tainted [ 1651.935172][ T4318] ------------------------------------------------------ [ 1651.942217][ T4318] kworker/u8:17/4318 is trying to acquire lock: [ 1651.948440][ T4318] ffffffff8ec847a0 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc_node_noprof+0x6a/0x610 [ 1651.958339][ T4318] [ 1651.958339][ T4318] but task is already holding lock: [ 1651.965699][ T4318] ffff88809a571d60 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: inet_stream_connect+0x51/0xa0 [ 1651.975354][ T4318] [ 1651.975354][ T4318] which lock already depends on the new lock. [ 1651.975354][ T4318] [ 1651.985759][ T4318] [ 1651.985759][ T4318] the existing dependency chain (in reverse order) is: [ 1651.994857][ T4318] [ 1651.994857][ T4318] -> #7 (k-sk_lock-AF_INET6){+.+.}-{0:0}: [ 1652.002808][ T4318] lock_sock_nested+0x41/0x100 [ 1652.008120][ T4318] __inet6_bind+0x301/0xf30 [ 1652.013163][ T4318] mptcp_bind+0x110/0x1d0 [ 1652.018151][ T4318] __sys_bind+0x2e3/0x410 [ 1652.023027][ T4318] __x64_sys_bind+0x7a/0x90 [ 1652.028064][ T4318] do_syscall_64+0x174/0x580 [ 1652.033183][ T4318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1652.039590][ T4318] [ 1652.039590][ T4318] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 1652.047324][ T4318] lock_sock_nested+0x41/0x100 [ 1652.052707][ T4318] inet_shutdown+0x6a/0x390 [ 1652.057876][ T4318] nbd_mark_nsock_dead+0x2cb/0x550 [ 1652.063535][ T4318] recv_work+0x1cee/0x1e10 [ 1652.068491][ T4318] process_scheduled_works+0xa8e/0x14e0 [ 1652.074566][ T4318] worker_thread+0xa47/0xfb0 [ 1652.079684][ T4318] kthread+0x388/0x470 [ 1652.084276][ T4318] ret_from_fork+0x514/0xb70 [ 1652.089390][ T4318] ret_from_fork_asm+0x1a/0x30 [ 1652.094667][ T4318] [ 1652.094667][ T4318] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 1652.102323][ T4318] __mutex_lock+0x19d/0x1550 [ 1652.107525][ T4318] nbd_queue_rq+0x373/0x1150 [ 1652.113273][ T4318] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1652.119429][ T4318] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1652.126358][ T4318] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1652.133089][ T4318] blk_mq_run_work_fn+0x16c/0x300 [ 1652.139268][ T4318] process_scheduled_works+0xa8e/0x14e0 [ 1652.145342][ T4318] worker_thread+0xa47/0xfb0 [ 1652.150452][ T4318] kthread+0x388/0x470 [ 1652.155044][ T4318] ret_from_fork+0x514/0xb70 [ 1652.160151][ T4318] ret_from_fork_asm+0x1a/0x30 [ 1652.165432][ T4318] [ 1652.165432][ T4318] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 1652.172646][ T4318] __mutex_lock+0x19d/0x1550 [ 1652.177758][ T4318] nbd_queue_rq+0xc1/0x1150 [ 1652.182781][ T4318] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1652.188843][ T4318] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1652.195691][ T4318] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1652.202278][ T4318] blk_mq_run_work_fn+0x16c/0x300 [ 1652.207833][ T4318] process_scheduled_works+0xa8e/0x14e0 [ 1652.214239][ T4318] worker_thread+0xa47/0xfb0 [ 1652.219345][ T4318] kthread+0x388/0x470 [ 1652.223935][ T4318] ret_from_fork+0x514/0xb70 [ 1652.229053][ T4318] ret_from_fork_asm+0x1a/0x30 [ 1652.234339][ T4318] [ 1652.234339][ T4318] -> #3 (set->srcu){.+.+}-{0:0}: [ 1652.241464][ T4318] __synchronize_srcu+0xc9/0x2f0 [ 1652.246932][ T4318] elevator_switch+0x1e8/0x7b0 [ 1652.252299][ T4318] elevator_change+0x2fa/0x480 [ 1652.257593][ T4318] elevator_set_default+0x375/0x440 [ 1652.263324][ T4318] blk_register_queue+0x3f3/0x4e0 [ 1652.268966][ T4318] __add_disk+0x6cb/0xe30 [ 1652.273821][ T4318] add_disk_fwnode+0xfb/0x4b0 [ 1652.279184][ T4318] nbd_dev_add+0x733/0xb60 [ 1652.284296][ T4318] nbd_init+0x15f/0x1e0 [ 1652.289007][ T4318] do_one_initcall+0x250/0x870 [ 1652.294319][ T4318] do_initcall_level+0x10a/0x1a0 [ 1652.299769][ T4318] do_initcalls+0x59/0xa0 [ 1652.304634][ T4318] kernel_init_freeable+0x29d/0x3e0 [ 1652.310349][ T4318] kernel_init+0x1d/0x1d0 [ 1652.315281][ T4318] ret_from_fork+0x514/0xb70 [ 1652.320405][ T4318] ret_from_fork_asm+0x1a/0x30 [ 1652.325685][ T4318] [ 1652.325685][ T4318] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 1652.333499][ T4318] __mutex_lock+0x19d/0x1550 [ 1652.338623][ T4318] elevator_change+0x1af/0x480 [ 1652.343909][ T4318] elevator_set_none+0xb5/0x140 [ 1652.349291][ T4318] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 1652.355615][ T4318] nbd_start_device+0x189/0xb30 [ 1652.361013][ T4318] nbd_genl_connect+0x1597/0x1c10 [ 1652.366564][ T4318] genl_family_rcv_msg_doit+0x233/0x340 [ 1652.372629][ T4318] genl_rcv_msg+0x614/0x7a0 [ 1652.377651][ T4318] netlink_rcv_skb+0x226/0x4a0 [ 1652.382964][ T4318] genl_rcv+0x28/0x40 [ 1652.387459][ T4318] netlink_unicast+0x7bb/0x940 [ 1652.392742][ T4318] netlink_sendmsg+0x813/0xb40 [ 1652.398028][ T4318] sock_sendmsg_nosec+0x13a/0x180 [ 1652.403567][ T4318] ____sys_sendmsg+0x54e/0x850 [ 1652.408851][ T4318] ___sys_sendmsg+0x2a5/0x360 [ 1652.414051][ T4318] __x64_sys_sendmsg+0x1b1/0x290 [ 1652.419507][ T4318] do_syscall_64+0x174/0x580 [ 1652.424615][ T4318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1652.431206][ T4318] [ 1652.431206][ T4318] -> #1 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 1652.439831][ T4318] blk_alloc_queue+0x544/0x690 [ 1652.445129][ T4318] __blk_mq_alloc_disk+0x194/0x390 [ 1652.450772][ T4318] nbd_dev_add+0x494/0xb60 [ 1652.455738][ T4318] nbd_init+0x15f/0x1e0 [ 1652.460447][ T4318] do_one_initcall+0x250/0x870 [ 1652.465930][ T4318] do_initcall_level+0x10a/0x1a0 [ 1652.471410][ T4318] do_initcalls+0x59/0xa0 [ 1652.476280][ T4318] kernel_init_freeable+0x29d/0x3e0 [ 1652.482006][ T4318] kernel_init+0x1d/0x1d0 [ 1652.486865][ T4318] ret_from_fork+0x514/0xb70 [ 1652.491976][ T4318] ret_from_fork_asm+0x1a/0x30 [ 1652.497282][ T4318] [ 1652.497282][ T4318] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 1652.504491][ T4318] __lock_acquire+0x1520/0x2cf0 [ 1652.510067][ T4318] lock_acquire+0x106/0x350 [ 1652.515114][ T4318] fs_reclaim_acquire+0x71/0x100 [ 1652.520674][ T4318] kmem_cache_alloc_node_noprof+0x6a/0x610 [ 1652.527008][ T4318] __alloc_skb+0x1d7/0x7a0 [ 1652.532046][ T4318] tcp_stream_alloc_skb+0x3f/0x580 [ 1652.537679][ T4318] tcp_connect+0x1582/0x53e0 [ 1652.542793][ T4318] tcp_v6_connect+0x14ed/0x1cf0 [ 1652.548160][ T4318] __inet_stream_connect+0x258/0xe00 [ 1652.553965][ T4318] inet_stream_connect+0x66/0xa0 [ 1652.559424][ T4318] kernel_connect+0x141/0x1c0 [ 1652.564616][ T4318] rds_tcp_conn_path_connect+0x6e9/0x920 [ 1652.570776][ T4318] rds_connect_worker+0x1d8/0x290 [ 1652.576418][ T4318] process_scheduled_works+0xa8e/0x14e0 [ 1652.582594][ T4318] worker_thread+0xa47/0xfb0 [ 1652.587823][ T4318] kthread+0x388/0x470 [ 1652.592433][ T4318] ret_from_fork+0x514/0xb70 [ 1652.597551][ T4318] ret_from_fork_asm+0x1a/0x30 [ 1652.602828][ T4318] [ 1652.602828][ T4318] other info that might help us debug this: [ 1652.602828][ T4318] [ 1652.613047][ T4318] Chain exists of: [ 1652.613047][ T4318] fs_reclaim --> sk_lock-AF_INET6 --> k-sk_lock-AF_INET6 [ 1652.613047][ T4318] [ 1652.626007][ T4318] Possible unsafe locking scenario: [ 1652.626007][ T4318] [ 1652.633454][ T4318] CPU0 CPU1 [ 1652.638854][ T4318] ---- ---- [ 1652.644224][ T4318] lock(k-sk_lock-AF_INET6); [ 1652.648906][ T4318] lock(sk_lock-AF_INET6); [ 1652.655923][ T4318] lock(k-sk_lock-AF_INET6); [ 1652.663129][ T4318] lock(fs_reclaim); [ 1652.667106][ T4318] [ 1652.667106][ T4318] *** DEADLOCK *** [ 1652.667106][ T4318] [ 1652.675238][ T4318] 4 locks held by kworker/u8:17/4318: [ 1652.680608][ T4318] #0: ffff8880315fd940 ((wq_completion)krds_cp_wq#23/0){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1652.692401][ T4318] #1: ffffc9000597fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1652.705290][ T4318] #2: ffff8880b4312180 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 [ 1652.716367][ T4318] #3: ffff88809a571d60 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: inet_stream_connect+0x51/0xa0 [ 1652.726500][ T4318] [ 1652.726500][ T4318] stack backtrace: [ 1652.732386][ T4318] CPU: 0 UID: 0 PID: 4318 Comm: kworker/u8:17 Not tainted syzkaller #0 PREEMPT(full) [ 1652.732455][ T4318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1652.732470][ T4318] Workqueue: krds_cp_wq#23/0 rds_connect_worker [ 1652.732500][ T4318] Call Trace: [ 1652.732510][ T4318] [ 1652.732520][ T4318] dump_stack_lvl+0xe8/0x150 [ 1652.732553][ T4318] print_circular_bug+0x2e1/0x300 [ 1652.732573][ T4318] check_noncircular+0x12e/0x150 [ 1652.732601][ T4318] __lock_acquire+0x1520/0x2cf0 [ 1652.732622][ T4318] ? rcu_is_watching+0x15/0xb0 [ 1652.732651][ T4318] ? __lock_acquire+0x683/0x2cf0 [ 1652.732677][ T4318] ? kmem_cache_alloc_node_noprof+0x6a/0x610 [ 1652.732700][ T4318] lock_acquire+0x106/0x350 [ 1652.732719][ T4318] ? kmem_cache_alloc_node_noprof+0x6a/0x610 [ 1652.732741][ T4318] ? ip6_dst_check+0xe2/0x7e0 [ 1652.732762][ T4318] fs_reclaim_acquire+0x71/0x100 [ 1652.732828][ T4318] ? kmem_cache_alloc_node_noprof+0x6a/0x610 [ 1652.732855][ T4318] kmem_cache_alloc_node_noprof+0x6a/0x610 [ 1652.732876][ T4318] ? ip6_default_advmss+0x80/0x3b0 [ 1652.732900][ T4318] ? __alloc_skb+0x1d7/0x7a0 [ 1652.732921][ T4318] ? __alloc_skb+0x1d7/0x7a0 [ 1652.732942][ T4318] __alloc_skb+0x1d7/0x7a0 [ 1652.732965][ T4318] tcp_stream_alloc_skb+0x3f/0x580 [ 1652.732988][ T4318] ? __asan_memset+0x22/0x50 [ 1652.733005][ T4318] tcp_connect+0x1582/0x53e0 [ 1652.733034][ T4318] ? ktime_get_with_offset+0x93/0x2d0 [ 1652.733059][ T4318] ? __pfx_tcp_connect+0x10/0x10 [ 1652.733077][ T4318] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 1652.733098][ T4318] ? lockdep_hardirqs_on+0x7a/0x110 [ 1652.733120][ T4318] ? ktime_get_with_offset+0x93/0x2d0 [ 1652.733138][ T4318] ? seqcount_lockdep_reader_access+0xea/0x100 [ 1652.733162][ T4318] ? __asan_memset+0x22/0x50 [ 1652.733180][ T4318] ? __pfx_tcp_fastopen_defer_connect+0x10/0x10 [ 1652.733288][ T4318] ? inet6_hash_connect+0xeb/0x170 [ 1652.733313][ T4318] tcp_v6_connect+0x14ed/0x1cf0 [ 1652.733335][ T4318] ? inet_csk_bind_conflict+0x60/0xa40 [ 1652.733360][ T4318] ? __pfx_tcp_v6_connect+0x10/0x10 [ 1652.733383][ T4318] ? inet_csk_get_port+0x11bc/0x1740 [ 1652.733401][ T4318] ? __local_bh_enable_ip+0xd0/0x130 [ 1652.733421][ T4318] ? __bfs+0x153/0x290 [ 1652.733440][ T4318] ? __bfs+0x153/0x290 [ 1652.733462][ T4318] __inet_stream_connect+0x258/0xe00 [ 1652.733485][ T4318] ? do_raw_spin_lock+0x12b/0x2f0 [ 1652.733500][ T4318] ? lock_sock_nested+0x6a/0x100 [ 1652.733519][ T4318] ? __pfx___inet_stream_connect+0x10/0x10 [ 1652.733540][ T4318] ? inet_stream_connect+0x51/0xa0 [ 1652.733560][ T4318] ? __local_bh_enable_ip+0xd0/0x130 [ 1652.733580][ T4318] inet_stream_connect+0x66/0xa0 [ 1652.733599][ T4318] kernel_connect+0x141/0x1c0 [ 1652.733617][ T4318] ? __pfx_kernel_connect+0x10/0x10 [ 1652.733637][ T4318] ? __local_bh_enable_ip+0xd0/0x130 [ 1652.733657][ T4318] rds_tcp_conn_path_connect+0x6e9/0x920 [ 1652.733680][ T4318] ? __pfx_rds_tcp_conn_path_connect+0x10/0x10 [ 1652.733697][ T4318] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1652.733716][ T4318] ? process_scheduled_works+0xa20/0x14e0 [ 1652.733733][ T4318] ? process_scheduled_works+0xa20/0x14e0 [ 1652.733754][ T4318] rds_connect_worker+0x1d8/0x290 [ 1652.733777][ T4318] ? process_scheduled_works+0xa20/0x14e0 [ 1652.733794][ T4318] process_scheduled_works+0xa8e/0x14e0 [ 1652.733823][ T4318] ? __pfx_process_scheduled_works+0x10/0x10 [ 1652.733844][ T4318] ? assign_work+0x3cf/0x5d0 [ 1652.733861][ T4318] worker_thread+0xa47/0xfb0 [ 1652.733891][ T4318] kthread+0x388/0x470 [ 1652.733913][ T4318] ? __pfx_worker_thread+0x10/0x10 [ 1652.733929][ T4318] ? __pfx_kthread+0x10/0x10 [ 1652.733951][ T4318] ret_from_fork+0x514/0xb70 [ 1652.733976][ T4318] ? __pfx_ret_from_fork+0x10/0x10 [ 1652.733996][ T4318] ? __switch_to+0xc89/0x1420 [ 1652.734017][ T4318] ? __pfx_kthread+0x10/0x10 [ 1652.734043][ T4318] ret_from_fork_asm+0x1a/0x30 [ 1652.734065][ T4318] [ 1653.149690][T24715] __nla_validate_parse: 22 callbacks suppressed [ 1653.149720][T24715] netlink: 44 bytes leftover after parsing attributes in process `syz.2.16390'. [ 1653.541534][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1653.691688][ T4318] net_ratelimit: 79 callbacks suppressed [ 1653.691710][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1653.705387][ T4318] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1653.821442][ T4317] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1653.829255][ T4317] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1653.942092][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1653.949900][ T4318] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1654.061563][ T4312] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1654.069840][ T4312] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1654.184431][ T4312] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1654.190608][T16317] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1658.021808][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1658.701647][ T4310] net_ratelimit: 91 callbacks suppressed [ 1658.701669][ T4310] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1658.715236][ T4310] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1658.831375][ T62] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1658.839192][ T62] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1658.951362][T31698] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1658.959159][T31698] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1659.071926][ T4312] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1659.079808][ T4312] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1659.191538][ T4318] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 1659.199872][ T4318] bond1: (slave ip6gretap1): failed to get link speed/duplex